Wireshark-dev: Re: [Wireshark-dev] Dissecting multiple protocol headers in a single plugin
From: Guy Harris <[email protected]>
Date: Tue, 3 Apr 2007 17:11:58 -0700
On Apr 3, 2007, at 4:53 PM, Bob Doolittle wrote:

Thanks.  My subdissector is now being called, and is updating the List
properly. But for some odd reason the sub-protocol isn't appearing in the
Details window tree, and I'm handling it identically to how I handled
the parent
protocol, which is drawing properly. I've verified that the proto has been
registered properly.  I've verified that the same tree is being
passed into the subdissector, and that it's making the
proto_tree_add_item call
for the proto in the parent tree, but it's not appearing.
So the "tree" argument to the subdissector is non-null?

What's the code in the subdissector that adds the top-level entry for the protocol?

Is there something special that has to occur for a single plugin to add two
separate protos to the tree?
A single plugin can contain multiple dissectors; they can be in a  
single source file, or multiple source files.
The only thing that's necessary for a single source file to contain  
multiple dissectors is to make sure that the registration and handoff- 
registration routines in that source file (there can be more than one  
such routine) register all the dissectors properly.
Are there any good examples of dissectors in the wireshark source that add multiple protocol layers to the tree? Is this bad practice - should I be using multiple plugins for multiple layers, and if so, how do I force them to be initialized in the necessary order (e.g. so that the parent proto can
create the dissector table before the child proto adds itself :)?
You should be using multiple *dissectors* for multiple protocol  
layers, but it sounds as if you're already doing that.
The problem probably has nothing to do with multiple dissectors in a  
plugin.  That works (see, for example, the DOCSIS plugin).