Wireshark · Ethereal-dev: Re: [Ethereal-dev] How to add a subprotocol?

[Guy Harris <guy@xxxxxxxxxx>]

> The protocol I'm dissecting has a "header" portion, that contains
> a "type field", and then a different "payload" for each type.
> 
> I'm stratagizing that while I could do it all in one dissector, it
> would be "more correct", if possible, to use Ethereal's selection
> machinery, and write seperate dissectors for each "type".
> 
> So a packet comes in, and the Ethernet dissector does it's thing, and
> then then IP dissector does it, and then the UDP dissector does it's part,
> and then my "main dissector" does the header, and then one of the
> "sub dissector" does the payload.
> 
> Possible? Doable? Easy?

Possible and doable - but if it's only one protocol, I wouldn't use
Ethereal's selection mechanism to do it, as Ethereal's selection
mechanism is intended for use when you have one protocol whose data is
carried inside another protocol, e.g. DNS carried inside UDP carried
inside IP carried inside Ethernet.

Your example sounds more like, for example, the different types of DNS
messages, rather than DNS vs. SNMP vs. RADIUS vs. NetBIOS Name
Service etc.; the DNS dissector doesn't treat each request type as a
different protocol, using "dissector_add()" to register dissectors for
each protocol type.