Wireshark · Wireshark-dev: Re: [Wireshark-dev] Passing data from Plugin dissector to a standard wireshark dissector (i.e. TCP)

[Mike Morrin <morrinmike@xxxxxxxxx>]

On 25/08/2012 15:06, hammad kabir wrote:
> Hi again,
>
> Any one having any other idea here. To put it short, I have written a
> plugin dissector for a custom protocol which works fine in wireshark,
> but as a next step I want rest of packet data to be decoded by a higher
> layer protocol dissector of wireshark (e.g. TCP or UDP, depending on a
> field value of custom protocol). Can you please guide me, as to what
> steps should I take in to account to get this task done.


In this respect a plug in dissector is the same as a built in dissector.

Declare dissector handles:
static dissector_handle_t udp_handle, tcp_handle;

Define a function such as:
void proto_reg_handoff_your_dissector_name(void)
{
    udp_handle = find_dissector("udp");
    tcp_handle = find_dissector("tcp");
}

Then in your dissector code:
{
...
   if (is_udp)
     call_dissector(udp_handle, next_tvb, pinfo, tree);
   else
     call_dissector(tcp_handle, next_tvb, pinfo, tree);
}