Ken Thompson (no, not that one) has written an article at The Code Project that shows how to write a protocol dissector for Wireshark.
Find out more about the new WCA certification
