Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Porting Ethereal dissectors to Wireshark

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Thu, 29 Oct 2009 22:47:44 -0400
Gustavo wrote:
Hi everybody,
I'm trying to port some dissectors from Ethereal to Wireshark plugins. They work and build without any problems in Ethereal (version 0.99.0) but when I try to separate and build them in Wireshark I have a lot of linking (unresolved symbol) problems. It seems like that functions/data structures in ethereal files (and needed and included by the dissectors) have been removed or renamed in the corresponding Wireshark files (usually located under the epan directory). If I import in the plugin the Ethereal version of the included files I can
build some plugins (for others there are too many files to import).

Is it so difficult to port a dissector from Ethereal to Wireshark? Reading the code they seems quite similar. Am I doing something wrong? Is there any guide dedicated to the transition from Ethereal to Wireshark?


I can only say that there's been a *lot* of changes since 0.99.0 which is 3 years old.

Even so, I would not have expected the required changes to use a plugin with the current Wireshark to to be too major.

Can you provide some specific examples of the unresolved symbols you are encountering when you try to build with current Wireshark ?

It's also possible that the "plug-in API" may have changed. I'm sure someone can jump in with information as to any API changes.

(Looking at the commit history for one of the plugins I do see a comment from about 2+ years ago saying "get rid of the old-style plugin registration stuff").

I'm not aware of any specific guide to migrating a plugin from 0.99 to a current Wireshark version.

(The real issue is migrating a plugin from 0.99.0 to current and not specifically about anything to do with the change from Ethereal to Wireshark).