Wireshark-dev: Re: [Wireshark-dev] Help with dissector code
From: Jeff Morriss <[email protected]>
Date: Tue, 17 Jun 2008 15:14:10 -0400

Michael A. Ruzinsky wrote:
I have just gone through the packet-foo.c dissector example in the documentation and was able to
compile and dissect the example data correctly.  Now I would like to try to re-write it so that
it handled pcap files with a data link type of 147 (USER0).  My code compiles but it doesn't
seem to have any effect on wireshark. I know there should be more code here, but I would think this would be enough to get wireshark to recognize the data as FOO. Any ideas?
Here is what I have so far in packet-foo.c:
[...]
void proto_reg_handoff_foo(void) {
    static gboolean initialized = FALSE;
    if (!initialized) {
        foo_handle = create_dissector_handle(dissect_foo, proto_foo);
        dissector_add("wtap_encap", WTAP_ENCAP_USER0, foo_handle);
        initialized = TRUE;
For that to work you're probably going to have to disable the DLT_USER 
(packet-user-encap.c) dissector--which is also registering for 
WTAP_ENCAP_USER0.
Or (better yet) use that dissector to send USER0 to your dissector 
(Edit->Preferences->Protocols->DLT_USER).