Ethereal-dev: Re: [Ethereal-dev] Delete some fields from packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 07 Dec 2004 11:08:37 -0800
Nemet, Hagay (Hagay) wrote:


 We sending  packets  that the protocol is proprietary.

 To change those packets to regular recognize packets we should

 omit 4 bytes and shift left the packet 4 bytes.
So does this mean you have a proprietary protocol where packets have a 4-byte header followed by a packet for some other protocol? 

If so, then:


 I would like to display those packets as recognize form, how can I do that?
...you should write a dissector for your proprietary protocol that displays the 4-byte header and then constructs a subset tvbuff that consists of the rest of the packet, after the 4-byte header, and calls the dissector for the protocol encapsulated inside your proprietary protocol.