Ethereal-dev: Re: [Ethereal-dev] Dissection Process

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Wed, 01 Feb 2006 22:32:52 +0100
Jasim Tariq wrote:
Does ethereal dissect a protocol only while doing a live capture? I am loading an old capture file and trying to observe a protocol under the TCP Protocol. I have defined a TCP port number in the sourse code of my dissector but when I load the previously captured file, Im still not able to see the protocol relating to that TCP port. Ethereal only identifies it as a TCP protocol. Therefore I am guessing that ethereal can only dissect a protocol while doing live capture. Please correct me if I'm wrong. 


No.
Ethereal will dissect a packet each time it reads the packet data, coming from a live capture or from reading a capture file makes no difference.
It will also dissect packets for other reasons, namely coloring rules and if a specific packet is selected in the packet list. 

Regards, ULFL