Wireshark · Wireshark-users: Re: [Wireshark-users] Need to associate a plugin with an encapsulation type code

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Gil Berglass wrote:
> I have software-generated "capture" files containing data packets for an 
> experimental protocol. Each packet has a libpcap header with 155 (one of 
> the "Reserved for Private Use" codes) in the network field.  I have 
> built a dissector for this protocol that I would like to check out, but 
> I don't know how to get Wireshark to invoke my dissector when it sees 
> this network code in the file (there's no "live" data).  Is there 
> something I need to put into my dissector source? Is there something I 
> need to put into one of the plugin makefiles? My system is Red Hat Linux.

Edit->Preferences->Protocols->DLT_USER

Click Edit (the Encapsulation Tables)
Click New
Choose DLT 155
Put your dissector's (short) name in "payload_proto"