Wireshark · Wireshark-users: Re: [Wireshark-users] "Decode payload as" option

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

I came across this bit in the TIPC dissector. I'm not sure what to make of it 
since I don't know the protocol and/or how you use it for your transport.

    /* this allows e.g. to dissect everything which is TIPC Data */
    tipc_user_dissector = register_dissector_table("tipc.usr",
                    "TIPC user", FT_UINT8, BASE_DEC);
    /* this allows to dissect everything which is TIPC Data and uses a  specific
     * port name type it actually does not really work because the type is not
     * necessarily set in every data message */
    tipc_type_dissector = register_dissector_table("tipcv2.port_name_type",
                    "TIPC port name type", FT_UINT32, BASE_DEC);

So, registering IPv4 with either of these tables may work.

Thanks,
Jaap

On 04/12/2012 09:14 AM, Erik Hugne wrote:
> Hi.
> I'm developing a tunnel interface driver for the TIPC protocol, this will
> transport data in frames as:
> +--------+
> |Ethernet|
> +--------+
> | TIPC |
> +--------+
> |Payload |
> +--------+
>
> Where payload is usually IPv4 or IPv6.
> There's no indication of the payload type in the TIPC protocol level.
> I want to be able to decode the payload manually as IPv4 for example.
> Can this be done?
>
> PS.
> I tried the decode-as option, but this can only handle decoding at the link-level.
>
> //E