Wireshark-dev: [Wireshark-dev] Help with dissector code
From: "Michael A. Ruzinsky" <[email protected]>
Date: Sun, 15 Jun 2008 02:26:28 -1000
I have just gone through the packet-foo.c dissector example in the documentation and was able to
compile and dissect the example data correctly.  Now I would like to try to re-write it so that
it handled pcap files with a data link type of 147 (USER0).  My code compiles but it doesn't
seem to have any effect on wireshark.  I know there should be more code here, but I would 
think this would be enough to get wireshark to recognize the data as FOO.  Any ideas?

Here is what I have so far in packet-foo.c:

#   include "config.h"


void proto_register_foo();
void proto_reg_handoff_foo();
void dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);

static int proto_foo = -1;
static dissector_handle_t foo_handle;

void proto_register_foo(void) {
    if (proto_foo == -1) {
        proto_foo = proto_register_protocol (
            "FOO Protocol", /* name */
            "FOO",          /* short name */
            "foo"           /* abbrev */

void proto_reg_handoff_foo(void) {
    static gboolean initialized = FALSE;
    if (!initialized) {
        foo_handle = create_dissector_handle(dissect_foo, proto_foo);
        dissector_add("wtap_encap", WTAP_ENCAP_USER0, foo_handle);
        initialized = TRUE;

void dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
    if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
        col_set_str(pinfo->cinfo, COL_PROTOCOL, "FOO");
    if (check_col(pinfo->cinfo, COL_INFO)) {
        col_clear(pinfo->cinfo, COL_INFO);

Instantly invite friends from Facebook and other social networks to join you on Windows Live™ Messenger.