Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Generic Dissector

From: wsgd <wsgd@xxxxxxx>
Date: Tue, 02 Dec 2008 22:02:50 +0100
Thanks for your interest.
But, I have to say that almost nobody else seems interested !


Note I am really far to well know the inside of wireshark,
So I do not see the reason for which it must not be a dissector.

Seems to work well with the current implementation of my plugin.
When register is called :
- it search into some directories for all *.wsgd files
- and for each .wsgd file
-- read and interpret it
-- build internal data structure corresponding to the packet format
It is able to manage up to 20 files .wsgd (could be easily increased).


Plugin compilation and installation is also really faster.
Note also that most of the source code is C++,
 so I think that integration inside wireshark is not for tomorrow.

Ultimately ? Who knows !


Olivier


Guy Harris a �crit :
On Nov 12, 2008, at 12:10 PM, wsgd wrote:

If you are interested, tell me.

It's definitely interesting, but it should ultimately not be a dissector - it should be a mechanism built into libwireshark, so that it's a standard feature of Wireshark and TShark.

The code to read and interpret those files should be in libwireshark, and, when Wireshark or TShark start up, they should scan a subdirectory of the Wireshark data directory, reading in the dissector files (for example, it should look for all .fdesc files and, for each file, try to open that file and the corresponding .wsgd file and read them).

The dissector_handle structure defined in epan/packet.h would have the "is_new" Boolean replaced by an enumerated type, with values for old- style compiled dissectors, new-style compiled dissectors, and interpreted dissectors; a new element in the "dissector" union would be added, which would point to a data structure that refers to all of the information read in from the .fdesc and .wsgd files.

call_dissector_work(), in epan/packet.h, would, for handles that refer to interpreted dissectors, run the interpreter.


_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-dev