Wireshark-dev: [Wireshark-dev] Recursive Heuristic Dissectors calls
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Alex Lindberg <alindber@xxxxxxxxx>
Date: Wed, 5 Oct 2011 15:28:31 -0700 (PDT)
I have a custom protocol that uses a well know TCP port and a such have connected a heuristic dissector to tcp.

My dissector works fine if there is only my custom protocol in the packet, but I have run into a case where the first part of the packet has several groups of my protocol, but at the end is a normal h248 chunk of data.

How should I handle this?  I would like for the TCP dissector to try a heuristic dissector look up after each chuck of custom data.  After a quick look at the TCP dissector, it  appears that "dissector_try_heuristic", defined in epan/proto.c, is called only once per packet.

Any ideas? 

Thanks as always.
Alex Lindberg