Wireshark-dev: Re: [Wireshark-dev] SPX protocol subdissector
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 24 Nov 2011 12:11:21 -0800
On Nov 24, 2011, at 11:44 AM, Andreas wrote:

> You can only use add your dissector for fields that are registered with register_dissector_table for this purpose.

...and they're not fields, they're just dissector tables; by *convention*, dissector tables are often given the same name as fields, if they happen to correspond exactly to one particular field, but that's not a requirement - there's no field named "ethertype", but there's a dissector table named "ethertype", which is used for several fields (the type field in Ethernet packets, the protocol ID field in SNAP packets with an OUI of 00:00:00, etc.), and most fields don't have dissector tables associated with them.

> I fear you can't register your dissector without changing packet-ipx.c.

...by adding a new dissector table and code to use it.

> I am not experienced with heuristic dissectors. Probably you can register your dissector with "spx" using heur_dissector_add().

No - you'd have to add a heuristic dissector table to the SPX dissector, so you can't even register it heuristically without changing packet-ipx.c.