Wireshark · Ethereal-users: Re: [Ethereal-users] Re: Newbie Dissector question

[linux lover <linux_lover2004@xxxxxxxxx>]

Hello,
--- ronnie sahlberg <ronniesahlberg@xxxxxxxxx> wrote:
> Correct.
> 
> The dissector_add() lines registers the ip dissector
> for those
> transports which transports ip.
> It just registers dissect_ip() in some external
> dissector tables.
> 
> Look inside packet-eth.c you will see the dissector
> table for things  
> running ontop of ethernet and see soemthing liek
> dissector_try_port() that will call the dissector
> registered in that
> table.
     I check that one. i found it in
packet-ethernet.c.
OK,so following function is used to search dissector
table for that packets handoff to next protocol.
dissector_found =
dissector_try_port(ethertype_dissector_table,
		    etype, next_tvb, pinfo, tree);

       Then why following is used in packet-eth.c 
fw1_handle = find_dissector("fw1");
        Does it not also finds next dissector routine
to handle packet?
regards,
linux_lover.


> 
> 
>  
> On Fri, 8 Apr 2005 02:25:56 -0700 (PDT), linux lover
> <linux_lover2004@xxxxxxxxx> wrote:
> > hello,
> >        Thanks for understanding me the various
> packets
> > handled by ip protocol.
> >       I have one more query in following function
> > void proto_reg_handoff_ip(void)
> > {
> >         dissector_handle_t ip_handle;
> > 
> >         data_handle = find_dissector("data");
> >         ip_handle = find_dissector("ip");
> > 
> >         dissector_add("ethertype", ETHERTYPE_IP,
> > ip_handle);
> >         dissector_add("ppp.protocol", PPP_IP,
> > ip_handle);
> >              So can i say in simple words that
> > dissector_add is used when ethereal got packets
> from
> > ppp interface or IP packets from NIC,then use
> > dissect_ip function in above case.
> > Please correct me.
> > 
> > Thanks for help.
> > regards,
> > linux_lover.
> > 
> > --- Guy Harris <gharris@xxxxxxxxx> wrote:
> > > LEGO wrote:
> > > 
> > > >>        dissector_add("ppp.protocol",
> > > ETHERTYPE_IP,
> > > >>ip_handle);
> > > > 
> > > > 
> > > > a different way to do IP over PPP (?)
> > > 
> > > More like "a different way of constructing a
> network
> > > stack", i.e. 
> > > Microsoft's way of constructing it, in which
> > > everything above the link 
> > > layer expects packets that look like Ethernet
> > > packets, and there's a 
> > > "glue layer" (NDISWAN) that translates between
> PPP
> > > and Ethernet packets, 
> > > and, apparently, you can, when capturing with
> > > WinPcap, see packets with 
> > > PPP headers with Ethernet types rather than PPP
> > > types in the prtoocol field.
> > > 
> > > >>        dissector_add("null.type",
> BSD_AF_INET,
> > > ip_handle);
> > > > 
> > > > IP over .... a null socket type????
> > > 
> > > IP over BSD loopback interfaces; the DLT_ name
> for
> > > that is DLT_NULL. 
> > > There's really nothing "null" about it - there's
> a
> > > link-layer header for 
> > > them, containing a 4-byte BSD address family
> value.
> > > 
> > > >>        dissector_add("chdlctype",
> ETHERTYPE_IP,
> > > ip_handle);
> > > > 
> > > > IP over ????
> > > 
> > > IP over "Cisco HDLC", a pre-PPP Cisco scheme for
> > > encapsulating packets 
> > > on a synchronous serial line.
> > > 
> > > >>        dissector_add("osinl.excl", NLPID_IP,
> > > ip_handle);
> > > > 
> > > > IP over  OSI Network Layer???
> > > 
> > > IP over the same layering scheme used for the
> OSI
> > > networking layer, with 
> > > a 1-byte protocol type field.
> > > 
> > > >>  dissector_add("wtap_encap",
> WTAP_ENCAP_RAW_ICMP,
> > > >>icmp_handle);
> > > > 
> > > > 
> > > >>            First one is ok that ICMP packet
> > > processed
> > > >>IP header and then giving data part to ICMP
> but
> > > what
> > > >>is other thing wtap_encap?
> > > > 
> > > > This I realy do not know, it might well be
> ICMP
> > > found raw in a pcap
> > > > file by wiretap.
> > > 
> > > Yes, it's raw ICMP in HP-UX nettl files.
> > > 
> > > _______________________________________________
> > > Ethereal-users mailing list
> > > Ethereal-users@xxxxxxxxxxxx
> > >
> >
>
http://www.ethereal.com/mailman/listinfo/ethereal-users
> > > 
> > 
> > __________________________________________________
> > Do You Yahoo!?
> > Tired of spam?  Yahoo! Mail has the best spam
> protection around 
> > http://mail.yahoo.com 
> > 
> > _______________________________________________
> > Ethereal-users mailing list
> > Ethereal-users@xxxxxxxxxxxx
> >
>
http://www.ethereal.com/mailman/listinfo/ethereal-users
> >
> 
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
>
http://www.ethereal.com/mailman/listinfo/ethereal-users
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com