Wireshark · Wireshark-dev: Re: [Wireshark-dev] Dissector being called with tree != NULL in the middle of the capture

[David Aggeler <david_aggeler@xxxxxxxxxx>]

>>A dissector is expected to be able to handle being called with tree null or non-null at any point;

Thanks for the clarification. I guess when I started I did not understand the readme.developer note on this topic. Now I do :-/
Would this mean, that this feature is mainly for single packet protocols or would named data sources solve this problem?

If so, any direction to a reference example would be appreciated.
I've read your Sharkfest 08 presentation and it sounds promising, but I didn't master it yet.

David

Guy Harris wrote:

On Oct 20, 2009, at 11:00 AM, David Aggeler wrote:

  

Is a dissector supposed to be able to handle something like this, i.e.
being called with tree specified somewhere in the middle of the  
stream?
    

Yes.  A dissector is expected to be able to handle being called with  
tree null or non-null at any point; it's up to the Wireshark/TShark/ 
etc. core to choose whether it needs, and hence asks for, a protocol  
tree or not.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe