Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] Order of subdissectors

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Thu, 15 Apr 2004 12:32:17 -0700 (PDT)
> Lars Ruoff wrote:
> If there is a conversation then the packet will not be dissected other
> dissectors even if RTP dissector would reject the packet.

We need some mechanism by which a packet can be rejected by a
non-heuristic dissector.  We currently have one - you can declare it as a
"new" dissector, which is expected to return 0 if it rejects a packet and
the number of bytes of data it dissected otherwise (so that if it only
dissects part of the tvbuff the caller knows how much was dissected -
there are places where that's used), but I'm not sure I like that, which
is why I haven't documented it or changed all non-heuristic dissectors to
be "new" dissectors.  I think, for example, there are places where a
dissector needs to be able to return 0 even if it *accepts* a packet - see
the code in "call_dissector_through_handle()" that arranges that it never
return 0 for "old" dissectors.  I don't remember what broke if it just
returned the length of the tvbuff handed to it; I'd probably have to get
rid of that code and do some regressions to see what breaks.

An alternative is to have dissector handles have two functions associated
with them, one of which checks whether the packet should be accepted and
one of which does the dissection.  The first function pointer could be
null, in which case the packet is always accepted.