Hi,
There is little difference in having your dissector in either a plugin
or build-in. On the Win32 platform you have limited function access
through what's listed in libwireshark.def, but that is mostly complete.
The big plus is that your rebuild cycle for a plugin is much shorter
than for a build in one. So starting of with a plugin makes initial
development simpler, while deployment of the finished code may well be
done as build-in dissector.
The agentx plugin is the current example, since the h323 dissector was
recently moved to be build-in.
Thanx,
Jaap
Németh Márton wrote:
Hi,
I would like to implement the USB Audio Subclass
( http://www.usb.org/developers/devclass_docs/audio10.pdf ) dissector for
Wireshark, so I started to read the documentation. In "Wireshark Developer's
Guide" ( http://www.wireshark.org/docs/wsdg_html/#ChDissectSetup ) it was
recommended to start a new dissector to be a "plugin". Is this the recommended
format or should I start writing the new dissector into
wireshark/epan/packet-usb-audio.c? What are the drawbacks and gains writing a
plugin vs. writing a built-in dissector?
I also found the following sentece:
"You can find a good example for these files in the h223 plugin directory."
However, the h223 packet dissector is located at wireshark/epan/dissectors/packet-h223.c,
so I assume it is not (or no longer) a plugin.
In the wireshark/doc/README.plugins (from current SVN), I found that I should take
the wireshark/plugins/agentx. So where should I start?
Márton Németh
