Wireshark-dev: Re: [Wireshark-dev] how do I know that a new capture has been started
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 21 May 2009 09:16:25 -0700

On May 21, 2009, at 8:23 AM, wsgd wrote:


Into a plugin dissector,
how do I know that :
- a new capture has been started
- a new file is loaded
You call register_init_routine() in your protocol registration routine, passing it a pointer to a function (no arguments, no return value) that's called before Wireshark makes a pass through a capture file and dissects all its packets. That function would clean up any state information from a previous capture file or a previous dissection of the current capture file.