Wireshark-dev: Re: [Wireshark-dev] Dissecting packets via wtap file
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 19 Feb 2010 11:21:42 -0800
On Feb 18, 2010, at 10:29 PM, Sajit Nayak wrote:

> I have my own file format. Now using the “open”, “read” and “seek and read” of wtap, can I decode the whole file.

What types of packets do you have in your file format?

If they're packets for a link-layer protocol that Wireshark already understands, then you just need to have Wiretap return the right WTAP_ENCAP_ value for that protocol.  For example, if they're Ethernet packets, use WTAP_ENCAP_ETHERNET.

If they're packets for a link-layer protocol that Wireshark *doesn't* already understand, you would need to:

	add a new WTAP_ENCAP_ value for that protocol;

	write a new dissector for that protocol, and have it register itself in the "wtap_encap" dissector table with the new WTAP_ENCAP_ value;

	possibly write dissectors for the protocols that run atop that protocol, if there are any and Wireshark doesn't already have dissectors for them (if there are some, and Wireshark *does* have dissectors for them, you would have to arrange that your dissector can call them).