Wireshark-dev: Re: [Wireshark-dev] Parsing variable length protocol trailer
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Tue, 27 Apr 2010 18:09:16 -0600
On Tue, Apr 27, 2010 at 12:22:14PM -0700, Edgar, Thomas wrote:

> Is there a way to determine how many bytes the subdissectors actually 
> used or how many bytes are left unused after a return from 
> dissector_try_port/heuristic?

If you were using call_dissector(), which lets you call a 
(sub-)dissector after looking up its handle by name, it will return the 
number of bytes dissected for new style dissectors (see 
call_dissector_work in epan/packet.c) or the length of the tvbuff for 
old style dissectors.  New style dissectors are registered with 
new_create_dissector_handle().

As for dissector_try_port(), it only returns TRUE if the dissector was 
found and FALSE if it wasn't.  The dissector_try_heuristic() function 
works in a similar fashion, returning TRUE if the packet was accepted by 
a dissector and FALSE if not.


-- 
Steve