ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] newbie question about dissecting protocol with many message subt

From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Sat, 02 Sep 2006 14:27:38 -0400
Hi, I'm trying to write a dissector for a proprietary protocol we have, and I'm trying to figure out the "preffered" way to write this code.

Any suggestions, including "go read X" or "go read X AGAIN" are welcome. :)

I've taken a look at the developer PDF and readme, and they've got me pretty far. I've got a basic dissector up and running. I've got our basic header done. Now I've got something like 100+ packet types. I'm trying to figure out how to set up fields.

Should I use field arrays? That seems like an awful lot of fields (100 * about 10) to add to the protocol's field list. Can you add a field list to a subtree? I see that NBNS defines multiple protocols. Should I define a different protocol for each message type? That also seems excessive.

Thanks,

Andy