Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Enabling protocol in Decode As dialog

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 10 Jun 2016 10:57:24 -0700
On Jun 10, 2016, at 10:40 AM, Robert Cragie <robert.cragie@xxxxxxxxxxxxx> wrote:

> It's more like a tunnelling protocol e.g. L2TP where L2 runs atop a L4 protocol - which is not "conventional".

"Conventional" is irrelevant to Wireshark - from the standpoint of Wireshark, X runs atop Y if:

	Y has a mechanism for handing its payload to other dissectors;

	X's dissector is one of the ones to which it can hand its payload;

regardless of where X and Y "normally" happen to live in the protocol stack.

So, if protocol Y has a dissector table and thus also has support for "decode as", registering X's dissector with Y is done the same way regardless of whether the layering is "conventional" or not; "unconventional" must not affect how you think of setting up your dissector - or how you ask about how to set up your dissector.