Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Dissector - how to reject packets

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Jul 2008 01:48:11 -0700

On Jul 9, 2008, at 6:50 PM, Barnes, Pat wrote:

The dissector I'm working on overrides the mbtcp dissector, to display a
particular subset of the protocol in application-specific detail.

"Subset" in what sense?

Does your dissector dissect some packets differently from the way the mbtcp dissector does, or does it, for example, dissect some fields that are just shown as uninterpreted bytes by the mbtcp dissector?

And how does it recognize the packets that it needs to dissect?