ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Dissector being called with tree != NULL in the middle of th

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 20 Oct 2009 14:38:18 -0700

On Oct 20, 2009, at 11:00 AM, David Aggeler wrote:

Is a dissector supposed to be able to handle something like this, i.e.
being called with tree specified somewhere in the middle of the stream?

Yes. A dissector is expected to be able to handle being called with tree null or non-null at any point; it's up to the Wireshark/TShark/ etc. core to choose whether it needs, and hence asks for, a protocol tree or not.