Wireshark · Ethereal-dev: [Ethereal-dev] smb, dcerpc, having old-style dissector call a tvbuff one?

[Todd Sabin <tas@xxxxxxxxxxx>]

Hi,

I started looking at hooking up the SMB and dcerpc dissectors, but
it's not at all clear how to get an old style dissector to call into a
tvbuff style one.

I hacked up a tvbuff_t in packet-smb-pipe.c similar to the way it was
done in packet-gtp.c.  I.e., allocated a new one, copied data from the
packet data from smb, and then passed that along to dissect_dcerpc_cn.
It kinda worked.  The summary lines look correct, however, the proto
tree is missing the DCERPC part of the tree.  Tracing in with gdb, it
happens that in proto_tree_draw_node, find_notebook_page is failing
for the dcerpc node.  I'm guessing that what I've done isn't exactly
the Right Thing.  :)

Is there a 'clean' way to do what I want: have an old style dissector
(SMB) hand off to a new style one (DCERPC)?  Or is the only hope to
tvbuffify SMB?

Thanks,


Todd