Wireshark · Wireshark-dev: Re: [Wireshark-dev] dissector_add(tcp.proto... / where to find parameter for dissector_add()

[Graham Bloice <graham.bloice@xxxxxxxxxxxxx>]

Armin Zimmermann wrote:

But there is another question: How can I check whether it is a UDP-package
or a TCP-package? Is there something like ip.proto==0x06 ?
    

The reason I want to know this is that tvb_reported_length() gives me the length of the data without the TCP-Header but in case of an UDP package it gives me the length of the data included the UDP Header. Is there another possibility to get the length without the UDP Header?

Thanks
Armin


  

Can't you have two entry points for your dissector, one for tcp, one for udp, register them with the appropriate dissectors and then have those entry points call your main dissector passing in flags etc as required.

-- 
Regards,

Graham Bloice