Wireshark-dev: Re: [Wireshark-dev] dissecting data portion of IP

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 31 Oct 2007 15:03:12 -0700

On Oct 31, 2007, at 1:58 PM, Daniel Roman wrote:

I'm attempting to do the same on my own dissector but I'm not to sure on what to use for the second argument of dissector_add. (TCP dissector uses IP_PROTO_TCP)

...which is the protocol type value for TCP in the IP header (6), so...

The IP Header of my packet contains 0xC8 for the Protocol Type. Can I do dissector_add("ip.proto", 0xC8, myprotocol_handle); to instruct wireshark to call my dissector if an IP protocol type of 0xC8 is encountered?

...that is what you should do.