Wireshark · Ethereal-dev: Re: [Ethereal-dev] Calling other dissectors

[Guy Harris <guy@xxxxxxxxxx>]

On Wed, Dec 11, 2002 at 02:54:08PM +0100, Marc Van Riet wrote:
> We're having a setup where ethernet packet X  of a certain source is 
> captured, wrapped in another packet (together with some logging 
> information) and re-transmitted over another ethernet port.
> 
> I've written a dissector that displays our logging information.  I 
> display the original ethernet packet X as hex data.  How can I make 
> ethereal show packet X decoded as an ethernet packet ?

In the proto_reg_handoff routine for your dissector, fetch the dissector
handle for the Ethernet dissector with

	eth_handle = find_dissector("eth");

where "eth_handle" is a "static dissector_handle_t" variable with file
scope (the name needn't be "eth_handle", obviously).

Then, in your dissector, construct a tvbuff, using "tvb_new_subset()",
that refers to the Ethernet-packet payload of your logging packet (if
you're not already doing so).  Then call the Ethernet dissector, handing
it that tvbuff, using "call_dissector()":

	call_dissector(eth_handle, new_tvb, pinfo, tree);

> The documentation on using dissector_next() is scarce.  Is 
> dissect_next() obsolete ?

It's nonexistent (regardless of whether you spell it "dissector_next()"
or "dissect_next()", which is why it's not documented. :-))