Wireshark-dev: [Wireshark-dev] Adding new dissectors
From: Rayne <[email protected]>
Date: Wed, 11 Mar 2009 22:52:50 -0700 (PDT)

I would like to know if adding a new dissector would require modifying/adding this dissector to the code of the dissector that may later call it.

For example, I was looking at packet-gtp.c, and in proto_re_handoff_gtp(), dissector_add() was used to add UDP and if neccessary, TCP. Looking at dissector_add(), it appears that it would call dissector_add_handle() to add GTP as a sub-dissector to UDP and/or TCP. All of this is done only in packet-gtp.c and not in packet-udp.c or packet-tcp.c.

If my reasoning is correct, am I right to say when I add a dissector, I need not modify the codes of the protocol layers below it? For example in this case, if I were to add the GTP dissector, I only need to specify and add the layers below it (UDP and/or TCP) in its own code. As for protocol layers above it, I would just use call_dissector whenever appropriate?

Thank you.