Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Need to associate a plugin with an encapsulation type code

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 10 Apr 2008 14:28:05 -0400


Gil Berglass wrote:
I have software-generated "capture" files containing data packets for an experimental protocol. Each packet has a libpcap header with 155 (one of the "Reserved for Private Use" codes) in the network field. I have built a dissector for this protocol that I would like to check out, but I don't know how to get Wireshark to invoke my dissector when it sees this network code in the file (there's no "live" data). Is there something I need to put into my dissector source? Is there something I need to put into one of the plugin makefiles? My system is Red Hat Linux.

Edit->Preferences->Protocols->DLT_USER

Click Edit (the Encapsulation Tables)
Click New
Choose DLT 155
Put your dissector's (short) name in "payload_proto"