Wireshark · Ethereal-dev: Re: [Ethereal-dev] reassemble packets to identify a higher level protocol

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

On Thu, 23 Sep 2004 bujecas@xxxxxx wrote:

> It's possible to build a dissector or plugin that reassembles packets to
> a higher protocol stream?

Ehhm, check out reassemble.c. So, yes it's possible

> For example, I need to identify a Siebel login
> transaction, it lies on TCP packets, what I want to do is to reassemble
> these packets to identify that it's a Siebel login. If it's possible can
> you give some simple example?

See dissectors which offer the option in the preferences, like X.25, TPKT,
TNS...... Maybe someone can point to a simple example.

> thanks.
hava fun,
Jaap