Wireshark · Ethereal-dev: Re: [Ethereal-dev] direct dissect with plugin

[Guy Harris <gharris@xxxxxxxxx>]

Lars Dörner wrote:

> Is there a possibility to write in a plug-in something that allows ethereal
> to use the dissector automatically?
>
> I mean without selecting "decode as" ? 

If it's possible to do it when the dissector is built in, it's possible 
to do it if the dissector is a plugin.

> The Protocol is running on TCP.

You'd either need to

	1) specify some port as the port your protocol uses;

	2) have that port be a configuration option;

	3) come up with a heuristic that checks some data in the packet to see 
if it's a packet for your protocol;

if you want it to be automatic (and 2) isn't fully automatic - you'd 
still need to specify the port if it's not the current setting).