Wireshark-dev: Re: [Wireshark-dev] How to avoid dissection based on port defined by a different
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Wed, 15 Dec 2010 14:30:47 -0700
On Wed, Dec 15, 2010 at 03:02:31PM -0500, eymanm wrote:

> I have a dissector plugin that is registered with port A. Once in a 
> while, this dissector is not kicking in. It looks like it 
> "overpowered" by a dissector with registered port 3503 (lsp-ping). It 
> looks like port 3503 is defined in 
> epan\dissectors\packet-mpls-echo.c(39):#define UDP_PORT_MPLS_ECHO 
> 3503. Can somebody suggest how to avoid this trap?

In addition to Christopher Maynard's suggestions, the surest way to fix 
it is to make both dissectors "new-style" so that they verify that the 
traffic on the port they're registered on (3503) is the right traffic 
they're expecting and kick it back to Wireshark so that another 
dissector can be tried.  See README.developer in the doc directory for 
details on this.