Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] hello, and a question about making a layer 2 dissector

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 15 Dec 2008 17:53:55 -0800

On Dec 15, 2008, at 12:48 PM, Brett L. Trotter wrote:

I've googled around and looked at tutorials for creating dissectors, but couldn't find much in the way of detailed examples for creating a layer
2 dissector.

"Layer 2" in what sense? In the sense that the Ethernet dissector, or the 802.11 dissector, or the PPP dissector, is a layer 2 dissector?

If so, does your layer 2 protocol run atop some lower-level protocol, or is it the lowest level? If the former, what protocol does it run atop? If the latter, what capture files do you have that contain your protocol?