Wireshark-dev: Re: [Wireshark-dev] Dissector skipping packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Tue, 4 May 2010 22:58:15 -0600
On Tue, May 04, 2010 at 08:28:38PM -0700, Craig Bumpstead wrote:

> I have created a dissector for a proprietary dissector and at the 
> moment it doesn't seem to decode packets 3, 6, 9, 12 etc.
> 
> I have put a breakpoint on dissect_myproto(tvbuff_t *tvb, packet_info 
> *pinfo, proto_tree *tree), but it doesn't even enter that function on 
> the above listed packets.

> Not sure what is intercepting the packet before my dissector.

My first guess was that the packets not being handed to your dissector 
are TCP segments that are reassembled.  However, that would make more 
sense if it was dissecting packets 3, 6, 9 not everything but those.

What protocol(s) does your dissector use?  How are you registering it in 
proto_reg_handoff_<your proto>()?  Are packets 3, 6, 9 different in some 
way?


-- 
Steve