Wireshark · Wireshark-dev: Re: [Wireshark-dev] question(s) on the use of heur_dissector_add

[Brian Vandenberg <phantal@xxxxxxxxx>]

> BTW, does your protocol (which I assume runs atop HTTP) have a 
> Content-Type (media type) value associated with it?  If so, you might 
> want to register that media type in the "media_type" string dissector 
> table.

 Yes.  I did some toying around today with that and got it working by 
just adding it as a dissector for a media type of 
application/x-url-form-encoded, and I figured I'd just add, or not add, 
tree items and info to the summary depending on whether it really is one 
of our packets or not.  So, rather than returning a true/false from my 
heuristic dissector, I just dropped my heuristic code into a regular 
dissector function, and made some alterations as to what the meaning of 
the boolean I was using meant.

-Brian