Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Register dissector to MAC address

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 18 Dec 2007 02:33:51 -0800
Michael A. McCartney wrote:

Changing it to what we discussed would break what I have
and worst, probably would force me to hack packet-eth which
I'd rather not do.  Seems eth is a special case where both
the "framing" needs to be heuristic (as is now and used) as
well as the "payload" (not present like tcp/udp).   Is it
possible to do both, or is it either-or?

It's not possible to do both with the same mechanism.

There would need to be two heuristic dissector tables, one used before the Ethernet dissector does any work, and one used after it's dissected the Ethernet header.