Wireshark-bugs: [Wireshark-bugs] [Bug 4026] New Packet Dissector - jmirror
Date: Fri, 18 Sep 2009 12:16:02 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4026





--- Comment #6 from Jaap Keuter <[email protected]>  2009-09-18 12:16:01 PDT ---
(In reply to comment #5)
> I like the idea of prompting the user for a UDP port number.  Are there any
> existing dissectors that I can have a look (okay, steal from) that use this
> approach.  It would definitely be more straight forward that having to use the
> "Decode as.." approach.
> 
See doc/REAME.developer 2.6 User Preferences.
For an example see packet-bat.c:

        bat_module = prefs_register_protocol(proto_bat_plugin,
proto_reg_handoff_bat);

        prefs_register_uint_preference(bat_module, "batman.bat.port", "BAT UDP
Port",
                                       "Set the port for B.A.T.M.A.N. BAT "
                                       "messages (if other than the default of
4305)",
                                       10, &global_bat_batman_udp_port);

> Unfortunately the range idea won't work since the UDP port used in the packet
> mirror is completely arbitrary.
> 
> But how would the dissector get called in the first place if there are no UDP
> ports tied to it?  All of the examples I saw used the UDP port number as the
> linkage for automatically calling the customer dissector.
> 

It us based on heuristics, see doc/README.heuristics. The UDP dissector
maintains a heuristic dissector table where you can register to. For example
packet-3com-njack.c:
        heur_dissector_add("udp", dissect_njack_heur, proto_njack);


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.