ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Dissecting multiple protocol headers in a single plugin

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 3 Apr 2007 17:11:58 -0700

On Apr 3, 2007, at 4:53 PM, Bob Doolittle wrote:

Thanks.  My subdissector is now being called, and is updating the List
window
properly. But for some odd reason the sub-protocol isn't appearing in the
Details window tree, and I'm handling it identically to how I handled
the parent
protocol, which is drawing properly. I've verified that the proto has been
registered properly.  I've verified that the same tree is being
passed into the subdissector, and that it's making the
proto_tree_add_item call
for the proto in the parent tree, but it's not appearing.

So the "tree" argument to the subdissector is non-null?

What's the code in the subdissector that adds the top-level entry for the protocol?


Is there something special that has to occur for a single plugin to add two
separate protos to the tree?

A single plugin can contain multiple dissectors; they can be in a single source file, or multiple source files.

The only thing that's necessary for a single source file to contain multiple dissectors is to make sure that the registration and handoff- registration routines in that source file (there can be more than one such routine) register all the dissectors properly.

Are there any good examples of dissectors in the wireshark source that add multiple protocol layers to the tree? Is this bad practice - should I be using multiple plugins for multiple layers, and if so, how do I force them to be initialized in the necessary order (e.g. so that the parent proto can
create the dissector table before the child proto adds itself :)?

You should be using multiple *dissectors* for multiple protocol layers, but it sounds as if you're already doing that.

The problem probably has nothing to do with multiple dissectors in a plugin. That works (see, for example, the DOCSIS plugin).