As far as I know, it's not possible to do currently. I ran into a similar problem with the recently added "Wake On LAN" dissector. WOL isn't specific to any Ethertype, but since ether-wake uses Ethertype 0x0842, I registered that.
What I think is really needed, in both cases, is to be able to register as a heuristic dissector. That way, once handoff to your dissector is made, you can determine via whatever means necessary if the packet is actually for you or not. If it is, process it as appropriate and return TRUE; if not, return FALSE. I don't really know if packet-eth.c would lend itself well to supporting heuristic dissectors or not though.
Can anyone think of a reason NOT to add heuristic dissection support to packet-eth.c? Or does anyone have a better/alternate way to solve this?
- Chris
________________________________
From: wireshark-dev-bounces@xxxxxxxxxxxxx on behalf of HPfrommer@xxxxxxxxxxxx
Sent: Mon 11/12/2007 12:25 PM
To: wireshark-dev@xxxxxxxxxxxxx
Subject: [Wireshark-dev] Register dissector to MAC address
Hi,
I have an application where I receive specially formed frames from a specific unique MAC address.
Is it possible to register my dissector to a MAC address?
All I was able to do was registering a dissector to an ethertype like follows:
dissector_add("ethertype", 0x88ff, test_dissector);
But
dissector_add("eth.src", "01:02:03:04:05:06", test_dissector);
does not work (well actually it can't, because the second parameter should be guint32).
Is there any possibility to do this?
Actually, my packet has no unique ethertype so it would be important to register to the unique MAC :-( (very special application, you see).
Thanks for your help!
Best regards,
Holger Pfrommer
Hilscher Gesellschaft fur Systemautomation mbH
Rheinstr. 15, 65795 Hattersheim
Sitz der Gesellschaft: Hattersheim
Geschaftsfuhrer: Hans-Jurgen Hilscher
Registergericht: Amtsgericht Frankfurt/Main
Handelsregister: Frankfurt B 26873
www.hilscher.com <http://www.hilscher.com/>
-----------------------------------------
This email may contain confidential and privileged material for the
sole use of the intended recipient(s). Any review, use, retention,
distribution or disclosure by others is strictly prohibited. If you
are not the intended recipient (or authorized to receive for the
recipient), please contact the sender by reply email and delete all
copies of this message. Also, email is susceptible to data
corruption, interception, tampering, unauthorized amendment and
viruses. We only send and receive emails on the basis that we are
not liable for any such corruption, interception, tampering,
amendment or viruses or any consequence thereof.<<winmail.dat>>
