Wireshark · Wireshark-dev: Re: [Wireshark-dev] switch between protocols

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 8, 2010, at 7:39 AM, Christopher Maynard wrote:

> Lange Jan-Erik <Jan-Erik.Lange@...> writes:
> 
>> Dependent on the value of a type field I want to dissect a packet with
> protocol A or protocol B.
>>  
>> Is this a typical application for the use of a heuristic dissector? Or how can
> I realize the switch between the to protocolls?
> 
> A heuristic dissector is basically one that is handed a tvb and it must try to
> guess whether the data contained within the tvb is relevant to that particular
> dissector or not.
> 
> In this case, it doesn't sound to me like a heuristic dissector would apply. 
> Rather, if you have protocol X that contains a type field, such that when that
> type field is a specific value, 'A' for instance, you always know that the
> payload is protocol A, then you probably just want to directly call the
> dissector for protocol A.

Or you could have the dissector for the protocol containing the type field create a dissector handoff table, have the dissectors for protocols A and B register in that table with the appropriate values for the type field, and have the dissector for the protocol containing the type field use the handoff table in a call to dissector_try_port().