ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] How to avoid dissection based on port defined by a different

From: Christopher Maynard <Chris.Maynard@xxxxxxxxx>
Date: Wed, 15 Dec 2010 20:49:15 +0000 (UTC)
eymanm <eymanm@...> writes:

> I have a dissector plugin that is registered with port A. Once in a while,
this dissector is not kicking in. It looks like it "overpowered" by a dissector
with registered port 3503 (lsp-ping). It looks like port 3503 is defined
in epan\dissectors\packet-mpls-echo.c(39):#define UDP_PORT_MPLS_ECHO 3503. Can
somebody suggest how to avoid this trap?

A couple of quick suggestions:
1) Change the other application/protocol so it avoids using any registered
ports.  See http://www.iana.org/assignments/port-numbers

2) Although this seems rather silly to me, you could change the MPLS Echo
dissector's registered port preference via Edit -> Preferences -> Protocols ->
MPLS Echo -> MPLS Echo UDP Port.

3) You can try disabling Wireshark's MPLS Echo dissector altogether via Analyze
-> Enabled Protocols -> MPLS Echo.

That other application/protocol might just end up using another registered port
though, so if you choose either 2 or 3 above, you could end up running into this
again with another one of Wireshark's dissectors.