Wireshark · Wireshark-dev: Re: [Wireshark-dev] Possible bug with check_col?

[Ulf Lamping <ulf.lamping@xxxxxx>]

Brian Vandenberg wrote:
>   I'm writing a dissector that relies on the http dissector.  The 
> server's I'll be monitoring use ssl, so there's a requirement to use the 
> ssl dissector to decrypt the packets and hand them off to the http 
> dissector.
>
>   Requests & responses are both treated properly during dissection, so 
> that isn't an issue.  That is, with one caveat:  for some reason, the 
> following code never causes the columns to be changed in my dissector, 
> and it also seems to fail to do the same thing in the http dissector:
>
> if (check_col (pinfo->cinfo, COL_PROTOCOL))
>   col_set_str (pinfo->cinfo, COL_PROTOCOL, "ABBRV");
>
> if (check_col (pinfo->cinfo, COL_INFO))
>   col_set_str (pinfo->cinfo, COL_INFO, "Some info");
>
>   The columns continue to say:
>
> Protocol: TLSv1
> Info: [SSL segment of a reassembled PDU]
>
>   So, three questions: has anyone else seen this before, is this a bug, 
> and is there a workaround?
>
>   
Are you sure your dissector get's called at all?

It looks like an SSL reassembling is going on, without a data chunk for 
the upper layer protocol.

Regards, ULFL