Wireshark · Ethereal-dev: Re: [Ethereal-dev] call_dissector

[Guy Harris <gharris@xxxxxxxxx>]

Charles Wilkinson wrote:

> Right having decided that the only way to be
> understood is to send out the source

Good idea.

OK, it appears that you're special-casing the IP protocol number field, 
and calling a completely separate dissector for this "Optical Ethernet" 
protocol.  (I *still* think Nortel should have gotten a separate 
Ethertype for this protocol....)

That's probably a reasonable way to handle this; it avoids having to 
have a preference setting (unless the "IPLT" protocol, to which IP 
protocol number 129 is assigned, according to

	http://www.iana.org/assignments/protocol-numbers

is something other than "Optical Ethernet", and somebody contributes a 
dissector for "IPLT").

It also appears that "hlen" is, indeed, the Optical Ethernet equivalent 
of the IP header length, meaning that using "hlen - 26" as the payload 
length is wrong, as per my other mail, and that the total length field 
is used to set the length of the tvbuff, as per my other mail, so try 
setting next_tvb with

	next_tvb = tvb_new_subset(tvb, 26, -1, -1);

> There are still 5 bytes that aren't dissected
> but that shouldn't matter as long as I create a new
> tvb with the right length

That's the problem - you probably weren't doing that.