Wireshark · Wireshark-dev: Re: [Wireshark-dev] Extending the DHCP dissector

[Beth <beth.tridium@xxxxxxxxx>]

In the Wireshark wiki there is a Lua code example for a chained dissector:  
http://wiki.wireshark.org/Lua/Dissectors

It looks like they simply add the new dissector into the parent protocol's dissector table with the same port as the original, thereby overwriting its entry in the dissector table.  If you made a new bootp dissector as a plugin, could you do the same trick to replace the existing builtin dissector without having to rebuild Wireshark?  You'd have to build the plugin of course, but you wouldn't need a custom wireshark build.