Ethereal-dev: Re: [Ethereal-dev] COL_PROTOCOL problem

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Mon, 19 Feb 2001 13:24:48 -0800
On Mon, Feb 19, 2001 at 12:51:00PM -0800, Martin Thomas wrote:
> The background is this: I have rewritten the tpkt
> dissector from Andreas Sikkema (and called it RFC1006)
> so that it stands alone from q931. So far, so good.
> Then I added COTP as a sub-dissector. This works..
> (packets are dissected) but the COL_PROTO shows
> RFC1006.. unless I put that as a filter term, in which
> case, the protocol field changes to COTP.

That is usually a sign that dissector X only calls sub-dissector Y if
the "tree" argument is non-null.

If dissector X calls sub-dissector Y if the protocol-X packet contains a
protocol-Y packet, it must, in that case, call sub-dissector Y
*regardless* of whether a full protocol tree is being constructed or not
- i.e., regardless of whether the "tree" argument is null or not.

Otherwise, the dissector for protocol Y has no chance to update the
Protocol or Info column, or to build any state information it needs to
dissect later packets in the capture.