Wireshark · Wireshark-dev: Re: [Wireshark-dev] dissecting multiple instances of the same message within one TCP packet

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

When your dissector gets handed the payload loop the MSG_X dissector until
the payload is exhausted.

Like so

dissect_MSG_X(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree)
{
  /* dissect MSG_X */

  return size;
}

dissect_multiple_MSG_X(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
  size = dissect_MSG_X(tvb, offset, pinfo, tree);

  DISSECTOR_ASSERT(size);

  offset += size;
}

msg_x_handle = create_dissector_handle(dissect_multipls_msg_x, proto_msg_x);
dissector_add("tcp.port", 0x????, msg_x_handle);

Thanx,
Jaap

On Mon, 29 Jan 2007, Jim L Hartwig wrote:

> I am a new Wireshark user and developer.  Let me refer to my message of
> interest as MSG_X.  I have written a dissector that dissects MSG_X which
> is in the TCP payload. What's the best way to dissect multiple instances
> of MSG_X within one TCP packet ?
>
>
> Regards,
> Jim Hartwig
> Texas Engineering Center
> Voice:    972. 952. 3307
> Raynet:  427. 3307