Wireshark-dev: Re: [Wireshark-dev] adding an encap_type_info element
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Lange Jan-Erik <Jan-Erik.Lange@xxxxxxxxxxxxxx>
Date: Thu, 18 Nov 2010 14:47:55 +0100
I solved it using WTAP_ENCAP_USER0. ..I think a better solution was it if i could declare a really new "link type". But I think it is going well this way.
 
 
Von: wireshark-dev-bounces@xxxxxxxxxxxxx [wireshark-dev-bounces@xxxxxxxxxxxxx] im Auftrag von Lange Jan-Erik [Jan-Erik.Lange@xxxxxxxxxxxxxx]
Gesendet: Donnerstag, 18. November 2010 13:28
An: wireshark-dev@xxxxxxxxxxxxx
Betreff: [Wireshark-dev] adding an encap_type_info element

Hello,
 
I want to dissect a packet that is not ethernet compliant. In the following I decribe the strategy to realize this.
Can you tell me where I'm wrong?
 
1. I have to add a new encap_type_info element to the encap_table_base[] struct in the wtap.c file.
 /* WTAP_ENCAP_MYPHYLAYER */
 { "My Phy Layer", "myphylayer" },
 
2. In the wtap.h file I have to add a new #define element, ie.
#define WTAP_ENCAP_MYPHYLAYER                    129
 
3. Now I can add the dissecor:
dissector_add("myphylayer", WTAP_ENCAP_MYPHYLAYER, myprot_handle);
 
Is this correct in general or are there points missing?
 
Best regards
Jan