Wireshark · Ethereal-dev: Re: [Ethereal-dev] protocol handoff still confusing / README.developer out of date / "data" dissecto

[Jeff Morriss <jeff_morriss@xxxxxxxxxxx>]

Ulf Lamping wrote:

[...]

> In the lower layer code, the dissector will create a new tvb using 
> tvb_new_subset(), and then call the upper layer dissector using 
> call_dissector()
>
>
> The only thing still missing in my understanding is the data_handle in 
> the call to call_dissector(). At various places I've found:
>
> data_handle = find_dissector("data");
>
> but what's the use of this "data"?

It's useful if the dissector you're implementing has some payload that 
your dissector is not going to (or is not able to) interpret or hand off 
to another dissector.  This payload is considered a blob of "data" and 
the "data" dissector just displays how much data there is ("Data (XX 
bytes)") and allows the blob to be highlighted in the hex-data pane if 
you click on it.

For example if the MTP3 dissector does not find a higher level protocol 
(e.g., SCCP) to hand its payload off to, instead it hands the payload to 
the "data" dissector--this is a simple way to display the rest of the 
packet.