Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: [Ethereal-cvs] rev 13118: /trunk/epan/dissectors/: packet-frame.c /trunk/epan

[Guy Harris <gharris@xxxxxxxxx>]

julien.leproust@xxxxxxxx wrote:

> However, some protocols call the next dissector themselves, so we can't 
> intercept them so easily. I have no good idea about how to do this. It's 
> the case for RPC for example.

We could add this to other handoff mechanisms, such as the DCE RPC and 
ONC RPC ones.

That doesn't handle direct manual calls - I guess some of those could be 
changed to supply the extra information via pinfo->private_data, so they 
have the standard signature for a dissector.

Another possibility, however, might be to have those dissectors - which 
should be checking whether their protocol is enabled - call a routine 
that logs the protocol.  That routine could also check whether the 
protocol is enabled, and immediately return FALSE if not and append the 
protocol's short name and return TRUE if it is.

Note that there's at least one special case here - the ARP dissector 
hands off to the ATMARP dissector if the hardware address type is an RFC 
2225 ARP address.  The problem there is that it really wants to 
*rescind* the appending of "arp", and replace it with "atmarp".