Wireshark · Wireshark-dev: Re: [Wireshark-dev] Dissector Registration Query

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 23, 2008, at 6:47 PM, Kumar, Hemant wrote:

> So that it doesnt happen that any junk UDP packets gets dissected  
> just because it fulfilled initial conditions.

If you can't define initial conditions that can usually distinguish  
between packets for your protocol and packets not for your protocol  
and that can be implemented in a dissector, you can't use heuristic  
dissectors; you will have to let the *user* determine whether packets  
are for your protocol or not, and specify manually whether to dissect  
them as your protocol.

This would mean that you would have to define a preference for your  
protocol so that the user can specify which port or ports should be  
dissected as your protocol, or that you will have to register your  
dissector as a dissector that can dissect packets atop UDP with

	dissector_add("udp.port", <handle for your dissector>);

and let the user specify with the "Decode As" menu that packets to or  
from particular ports should be dissected as your protocol.