Guy Harris wrote:
> >
> > Can I use the dissector_add/rem functions at other
> > times besides inside proto_reg_handoff() to allow
> > my dissector to register/handle this new dynamic port
> > in the "tcp.port" dissector table or are there
> > restrictions ??
>
> You can call those functions at any time...
>
> ...but they won't necessarily have the effect you expect; changing the
> table of registered dissectors doesn't trigger a rescan of the entire
> capture, redissecting packets, which means it won't change the way
> packets to or from that port are shown.
>
> As another person noted, this is a job for conversation dissectors; that
> technique is used in the Quake RTSP, Microsoft Proxy, and SOCKS
> dissectors. See those dissectors ("packet-quake.c", "packet-msproxy.c",
> "packet-rtsp.c", and "packet-socks.c") for examples of how to do this
> (look for "conversation_set_dissector" - and do so in such a fashion
> that you also find "old_conversation_set_dissector", don't use any
> search technique that only works if you're calling a function named
> "conversation_set_dissector").
Thanks for the info, I will go and
pull up my socks (doh!).
/Frank..
--
EUS/SV/Z Frank Singleton ASO Americas BSS
Office : +1 972 583 3251 ECN 800 33251
Pager : +1 800 651 1184 Email : eusfrsi@xxxxxxxxxxxxxxx
Amateur Radio: VK3FCS/KM5WS Email : frank.singleton@xxxxxxxxxxxx
Hardware: HP Omnibook 4150 running Redhat Linux 6.2 (2.2.16 kernel).
