Wireshark · Wireshark-dev: Re: [Wireshark-dev] compiling dissector plugin

[Christopher Maynard <Chris.Maynard@xxxxxxxxx>]

Lange Jan-Erik <Jan-Erik.Lange@...> writes:

> Ok, before I go further I have to clarify some things. I want to implement a
protocol, that is not Ethernet
> compliant. As I see it, you can tell wireshark to use a certain dissector for
a certain protocoll and port by
> the function
> 	dissector_add("udp.port", FOO_PORT, foo_handle);
> 
> How can I implement a dissector for a non ethernet compliant protocoll?

dissector_add() is used for more than just UDP.  In fact, many dissectors
register their ethertypes using dissector_add("ethertype", ETHERTYPE_FOO,
foo_handle);  You will likely need to register similarly with whatever protocol
yours is encapsulated in.

Alternatively, you might use heur_dissector_add() if yours is a heuristic based
dissector, in other words if there's no definitive way for the protocol carrying
your traffic to know for certain if the traffic is yours or not.  Read more
about heuristic dissectors in doc/README.heuristic.