Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] How do I nest dissectors

From: "Hal Lander" <hal_lander@xxxxxxxxxxx>
Date: Thu, 16 Nov 2006 11:10:04 -0900
The protocol I want to dissect ' foo' is contained within the data of a UPD packet. Normall Wireshark would display the UPD packet showing it has a length of 44 bytes and displaying its source and destination. It would also show that the UDP packet contains 36 bytes of data (which is where my protocol is).

Once I introduce my dissector using
   dissector_add("udp.port", 2080, ff_handle);
Wireshark shows foo packets with a length of 44 and no other information.

I was expecting Wireshark to first dissect the UDP packet, then stat to dissect my foo protocol in the data of the UDP.

I am obviously not understanding how to nest the dissectors, can anybody point me in the right direction.

TIA
Hal

_________________________________________________________________
Get free, personalized commercial-free online radio with MSN Radio powered by Pandora http://radio.msn.com/?icid=T002MSN03A07001