Wireshark-dev: [Wireshark-dev] how do I create a dissector that doesn't set the Protocol column
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Fulko.Hew@xxxxxxxxx
Date: Fri, 13 Jul 2007 12:24:35 -0400
I'm making progress on my proprietary capture device, and the next step is
to create a dissector.  The first stages are OK, but now I'm trying
to capture and dissect packets with my WTAP type.

One of the issues is that there are existing well known protocols
embedded in my captured packets that I want to hand off to pre-existing
dissectors (for example 'frame relay') so I'm capturing the flow and
handing it off in dissect_mytype() using the fragment:

if (pinfo->fd->lnk_t == WTAP_ENCAP_MYTYPE) {
  call_dissector(frame_relay_handle, tvb, pinfo, tree);
}

So far so good, but two downsides are:

1/ The Protocol field in the packet list window pane now labels the
   packets as 'mytype'.  I'd rather see the protocol as 'Frame Relay',
   or (more generically) 'whatever the next dissector determines it to be'.

2/ The packet 'decode' pane shows:
   > Frame 1 (14 bytes on wire, 14 bytes captured)
   > Frame Relay
   > Q.933
   > MYTYPE

   As if 'MYTYPE' was embedded within the frame relay, whereas in
   reality, its the other way around.  It shouldn't have that 4th
   level of decode.

Can anybody tell me what I'm doing wrong, and/or missing?

TIA
Fulko



This document is strictly confidential and intended only for use by the addressee unless otherwise stated.  If you are not the intended recipient, please notify the sender immediately and delete it from your system.