Wireshark-dev: [Wireshark-dev] newbie question about dissecting protocol with many message subtypes

From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Sat, 02 Sep 2006 14:27:38 -0400

Hi, I'm trying to write a dissector for a proprietary protocol we have, and I'm trying to figure out the "preffered" way to write this code.

Any suggestions, including "go read X" or "go read X AGAIN" are welcome. :)

I've taken a look at the developer PDF and readme, and they've got me pretty far. I've got a basic dissector up and running. I've got our basic header done. Now I've got something like 100+ packet types. I'm trying to figure out how to set up fields.

Should I use field arrays? That seems like an awful lot of fields (100 * about 10) to add to the protocol's field list. Can you add a field list to a subtree? I see that NBNS defines multiple protocols. Should I define a different protocol for each message type? That also seems excessive.

Thanks,

Andy