Wireshark · Wireshark-dev: Re: [Wireshark-dev] question(s) on the use of heur_dissector_add

[Brian Vandenberg <phantal@xxxxxxxxx>]

 I've not found much documentation on this, so if this question can be 
answered by reading a document on this, let me know.

 I created a heuristic dissector function and registered it like so:

heur_dissector_add ("http", dissect_test, proto_test);

 The server listens on port 80 (among others).  I have had an 
interesting time trying to figure out why my heuristic function isn't 
called, so I added a breakpoint inside dissect_http to this if statement:

...
if (handle != NULL) {
 // call subdissector
}
else {
 // call dissector_try_heuristic
}

 As far as I can tell, basically, I can't use a heuristic dissector to 
dissect anything http has already looked at if another dissector has 
registered itself as a subdissector for the given port.  Is that about 
accurate?  Is there something I'm missing?  Is there another way to 
accomplish what I'm trying to do?

-Brian