Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Advice for dissector

From: Marc Petit-Huguenin <marc@xxxxxxxxxxxxxxxxxx>
Date: Thu, 20 Sep 2007 09:38:10 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I need an advice for a special case I'll have to implement.  The regular
packets to be dissected does not contains enough information to select
the right dissector, but there is at the beginning of the exchange some
packets that permit to choose this dissector.  Let me explain this with
an example:

IP/port 1          IP/port 2
   |                   |
1  |------------------>|
2  |<------------------|
   |                   |
3  |------------------>|
4  |<------------------|
5  |------------------>|
6  |<------------------|
   |                   |

The packets 1 and 2 contains enough information to select the dissector
that will be used to dissect packets 1 to 6, but packets 3 to 6 does
not.  Is there a way to express that after packet 2, all the subsequent
packets on this specific pair of IP/port will always use the same
dissector?  Obviously, if the packets 1 and 2 are missing, then the
dissector cannot be selected.  Packets can be carried by UDP or TCP (or
SCTP or DCCP...)

The name of an existing dissector implementing something similar would
also be useful.

Thanks.

- --
Marc Petit-Huguenin           [                                 ]
Home: marc@xxxxxxxxxxxxxxxxxx [RFC1855-compliant space for rent ]
Work: marc@xxxxxxx            [                                 ]
[                                                               ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFG8qHy9RoMZyVa61cRAsT3AJ0e1xd3OP1M3DqzJT0pXyXHyYgZcgCaA6sh
+3KSbKGorfN6kBtP/ktV/TQ=
=n0q3
-----END PGP SIGNATURE-----