Wireshark · Wireshark-dev: Re: [Wireshark-dev] How to avoid dissection based on port defined by a different dissector?

[Christopher Maynard <Chris.Maynard@xxxxxxxxx>]

eymanm <eymanm@...> writes:

> I have a dissector plugin that is registered with port A. Once in a while,
this dissector is not kicking in. It looks like it "overpowered" by a dissector
with registered port 3503 (lsp-ping). It looks like port 3503 is defined
in epan\dissectors\packet-mpls-echo.c(39):#define UDP_PORT_MPLS_ECHO 3503. Can
somebody suggest how to avoid this trap?

A couple of quick suggestions:
1) Change the other application/protocol so it avoids using any registered
ports.  See http://www.iana.org/assignments/port-numbers

2) Although this seems rather silly to me, you could change the MPLS Echo
dissector's registered port preference via Edit -> Preferences -> Protocols ->
MPLS Echo -> MPLS Echo UDP Port.

3) You can try disabling Wireshark's MPLS Echo dissector altogether via Analyze
-> Enabled Protocols -> MPLS Echo.

That other application/protocol might just end up using another registered port
though, so if you choose either 2 or 3 above, you could end up running into this
again with another one of Wireshark's dissectors.