Wireshark · Wireshark-dev: Re: [Wireshark-dev] Register dissector to MAC address

[Guy Harris <guy@xxxxxxxxxxxx>]

Michael A. McCartney wrote:

> Changing it to what we discussed would break what I have
> and worst, probably would force me to hack packet-eth which
> I'd rather not do.  Seems eth is a special case where both
> the "framing" needs to be heuristic (as is now and used) as
> well as the "payload" (not present like tcp/udp).   Is it
> possible to do both, or is it either-or?

It's not possible to do both with the same mechanism.

There would need to be two heuristic dissector tables, one used before 
the Ethernet dissector does any work, and one used after it's dissected 
the Ethernet header.