Wireshark · Wireshark-dev: Re: [Wireshark-dev] Different wireshark behaviour on Linux as on Windows

[Roland Knall <rknall@xxxxxxxxx>]

On Mon, Feb 28, 2011 at 9:51 AM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
>
> On Feb 28, 2011, at 12:32 AM, Roland Knall wrote:
>> On Windows, the SercosIII plugin takes precedence over my plugin. Both
>> register the same Ethertypes, therefore this should not be unusual,
>
> If you mean "it's not unusual that random stuff happens if two dissectors register with the same value in a given dissector table", that is correct.  We make no guarantee that this will do what the developer of the dissector, or the user, wants - in particular, we make no guarantee which dissector will win.

Ok, gathered as such.

>> So my question is, can I influence the decision made by wireshark in
>> any way, which plugin get's called?
>
> Try disabling the dissector for the protocol whose dissector you don't want called.

Sadly, this is not an option. The Sercos III plugin does not return
the number of bytes dissected though. Currently I am trying to figure
out, if a patch to the protocol might solve my issue.

The funny thing is, that this only seems to address plugins. If you
are racing against a dissector part of the original distribution of
wireshark (libwireshark), this behavious does not seem to occur, which
leads me to guessing it has something to do with the way, Windows and
Linux handle the loading of dynamic libraries.

regards, Roland