Ethereal-users: Re: [Ethereal-users] Development information...
On Tue, Apr 23, 2002 at 11:36:53AM -0700, Brian Jarrett wrote:
> I didn't see the answer to my question on the website, but I didn't spend a
> lot of time looking either. I work for Phoenix Technologies and I'm
> wondering what I would have to modify in Ethereal to get it to decode the
> packets we use with ImageCast.
You'd have to add a new dissector for your protocol.
Download the Ethereal source, and look at the "README.design",
"README.developer", "README.tvbuff", and "README.plugins" documents in
the "doc" directory.
> We use UDP multicast packets
If your protocol has a particular UDP port number assigned to it, you'd
use the "dissector_add()" routine to specify that it should be called
for UDP packets to or from that port.
Otherwise, you'd have to
1) make the port number a settable preference, with
"prefs_register_uint_preference()", and use "dissector_add()"
with the specified number (and arrange to re-register your
dissector if that preference changes)
or
2) make a "heuristic" dissector, which would look at the packet
and try to determine if it's an ImageCast packet and, if so,
dissect it and return TRUE, otherwise return FALSE (note that
this is a delicate art - if the heuristic is too loose, it'll
claim packets that *aren't* ImageCast packets, screwing up
other dissections, but, if it's too strict, it might miss
packets that *are* ImageCast packets).
