I've not found much documentation on this, so if this question can be
answered by reading a document on this, let me know.
I created a heuristic dissector function and registered it like so:
heur_dissector_add ("http", dissect_test, proto_test);
The server listens on port 80 (among others). I have had an
interesting time trying to figure out why my heuristic function isn't
called, so I added a breakpoint inside dissect_http to this if statement:
...
if (handle != NULL) {
// call subdissector
}
else {
// call dissector_try_heuristic
}
As far as I can tell, basically, I can't use a heuristic dissector to
dissect anything http has already looked at if another dissector has
registered itself as a subdissector for the given port. Is that about
accurate? Is there something I'm missing? Is there another way to
accomplish what I'm trying to do?
-Brian
