Wireshark · Wireshark-dev: Re: [Wireshark-dev] SPX protocol subdissector

["Helge Kruse" <Helge.Kruse-nospam@xxxxxxx>]

-------- Original-Nachricht --------
> Datum: Thu, 24 Nov 2011 12:11:21 -0800
> Von: Guy Harris <guy@xxxxxxxxxxxx>
> An: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
> Betreff: Re: [Wireshark-dev] SPX protocol subdissector

> 
> On Nov 24, 2011, at 11:44 AM, Andreas wrote:
> 
> > You can only use add your dissector for fields that are registered with
> register_dissector_table for this purpose.
> 
> ...and they're not fields, they're just dissector tables; by *convention*,
> dissector tables are often given the same name as fields, if they happen
> to correspond exactly to one particular field, but that's not a requirement
> - there's no field named "ethertype", but there's a dissector table named
> "ethertype", which is used for several fields (the type field in Ethernet
> packets, the protocol ID field in SNAP packets with an OUI of 00:00:00,
> etc.), and most fields don't have dissector tables associated with them.
> 
> > I fear you can't register your dissector without changing packet-ipx.c.
> 
> ...by adding a new dissector table and code to use it.
... what requires that you distribute your self-built Wireshark with your DLL.

Helge

-- 
Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de