Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Different wireshark behaviour on Linux as on Windows

From: Roland Knall <rknall@xxxxxxxxx>
Date: Wed, 9 Mar 2011 07:54:58 +0100
On Tue, Mar 8, 2011 at 4:41 AM, Chris Maynard <Chris.Maynard@xxxxxxxxx> wrote:
> Roland Knall <rknall@...> writes:
>
>> Ok, now I have a question.
>>
>> Both dissectors register on a certain Ethernet Frame Type (0x88CD). If
>> I disable the SercosIII dissector, in theory, my dissector should get
>> called, right?
> That would be my expectation as well.

It is definitly not the case. I also figured out the reason why.

On Linux, when the gtk-based filehandler loads the list of plugins, it
does so alphabetically. This does not seem to be the case on Windows.
So here, someone might argue, that this indeed is plattform-specific,
and not exactly a bug. You would have to sort the plugin load list to
fix it.

>> But no, even if I specifically disable the dissector, it still get's
>> selected via packet.c::dissector_try_uint_new but it get's not called.
>>
>> Is this a bug? Normally I would assume, that a disabled dissector
>> would not get selected here, but a non-disabled one would get the
>> top-vote
> This sounds like a bug to me as well.  You might want to file a bug report about
> it, and if at all possible, post your openSAFETY plugin (with the rest of the
> patches to Wireshark files), along with a small capture file to the bug report.

This is definitly a bug, but for now, I can live with the
consequences. I will file a report though.

> The only other thing I could suggest is to compile your dissector as a normal
> dissector instead of a plugin.  Does it need to be a plugin?

No, it does not. It was just convenient, during the main development
phase. I currently rework the whole thing, so it will be a normal
dissector, and then I will submit it for review.


regards, Roland