On Mon, May 28, 2001 at 07:52:10PM -0500, Patrick Hartling wrote:
> } > When I try to decode it using
> } > my dissector (through the Decode As ... menu option), the added protocol
> } > isn't showing up in the list.
> }
> } It'll only show up if either
> }
> } 1) the dissector is registered, using "dissector_add", with the
> } "tcp.port" dissector table (as a dissector for port 6000)
>
> This is being done in the proto_reg_handoff_xxx() function for the
> dissector.
Only one dissector per port number shows up in the hash table used both
for handoffs based on port number and used to generate the menu, so you
either will see only your dissector or will see only the X11 dissector,
depending on the order in which their handoff registration routines are
run (which is the order in which their handoff routines are called from
"register_all_protocol_handoffs()", which is the order in which they're
put into there by "make-reg-dotc", which is the order in which the
source files for the dissectors is scanned by "make-reg-dotc", which is
their order in "DISSECTOR_SRC" - except that it's done in two passes,
the first of which looks for "proto_reg_handoff_xxx" at the beginning of
the line and the second of which looks for "void proto_reg_handof_xxx"
at the beginning of the line, so dissectors that do
void
proto_reg_handoff_xxx(void)
{
...
}
get their handoff routines called before dissectors that do
void proto_reg_handoff_xxx(void)
{
...
}
.)
Either
1) you will have to build your own private version of Ethereal,
lacking an X11 dissector
or
2) you will have to register your dissector as a conversation
dissector and use the "Decode As" dialog box to force
Ethereal to dissect frames with your dissector
or
3) you will have to choose the name of the file containing your
dissector, and the fashion in which it declares its
"proto_reg_handoff_xxx()" routine, in such a fashion as to
have it be called *after* the X11 dissector (and be prepared
to have the order in which they're called change if the way
"register.c" is generated changed) - which means, in effect,
that the X11 dissector will never be used, so it's equivalent
to 1).
