ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Define dissector port

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 15 Jan 2007 10:37:39 -0800
Hal Lander wrote:
Is there a way to get a dissector to run on all ports?

A dissector that runs on all ports would have to be a heuristic dissector (otherwise, you wouldn't be able to dissect any TCP/UDP traffic except for traffic for your protocol).

So the way you'd do that would be to have your dissector be able to look at a packet and determine whether it's a packet for your protocol or not, and use a check for that sort in your dissector. See doc/README.developer for information on how to make a heuristic dissector. The name of the heuristic dissector table for TCP is "tcp", and the table for UDP is "udp".