11.20. User DLTs dissector table
When a pcap file uses one of the user DLTs (147 to 162) Wireshark uses this
table to know which dissector(s) to use for each user DLT.
This table is a user table, as described in Section 11.7, “User Accessible Tables”, with the
following fields:
- DLT
-
One of the user dlts.
- Payload dissector
-
This is the name of the payload dissector (the lowest layer in the packet data).
(e.g., “eth_withfcs, "eth_withoutfcs”, and "eth_maybefcs" respectively for Ethernet frames that do, do not, or might possibly include the FCS at the end, “ip” for trying IPv4 then IPv6)
- Header size
-
If there is a header (before the payload) this tells which
size this header is. A value of 0 disables the header dissector.
- Header dissector
-
The name of the header dissector to be used (uses “data” as default).
- Trailer size
-
If there is a trailer (after the payload) this tells which
size this trailer is. A value of 0 disables the trailer dissector.
- Trailer dissector
-
The name of the trailer dissector to be used (uses “data” as default).