I have a very basic question.From what i understand , dissector_add determines criteria of wireshark calling my dissector. Now suppose if i have udp.port==7011 kind of filter , then i guess the pointer of "tree"(in dissect_proto) starts from udp packet ? Am i correct ? What will happen if i am using heuristic dissector of "eth" ? asked 04 Jun '12, 03:04  yogeshg |
One Answer:
Not sure where you're going with this, but the pointer 'tree' may point to a node to which your dissector can add proto items. You cannot make assumptions on where this 'tree' is rooted, nor do you have to. You get your data passed down to your dissector in the tvb, and you add your proto items to the proto tree. That's basically it. answered 05 Jun '12, 04:04  Jaap ♦ |
Then how do i know where is correct place to add my proto items ?
As Jaap said, you just add items to the passed in proto tree, nothing to think about.
Your dissector will be called at the right point in the frame dissection as set up by your call to dissector_add_xxx.
If you add a heuristic dissector to the UDP dissector with heur_dissector_add(), your dissector will be added to the chain of heuristic dissectors for UDP, and may get called if nothing in front of you in the chain handles the data.
If you add a dissector to the UDP dissector using dissector_add_uint() with a port preference of 7011, then it will only be called when UDP traffic appears on port 7011.
If you add a heuristic dissector to the eth" dissector your dissector will be added to the chain of heuristic dissectors for ethernet, and may get called if nothing in front of you in the chain handles the data.
so basically , tree will automatically point at the start of the data which is relevant to my protocol because when we call for eg,
hb_tree = proto_item_add_subtree(ti, ett_hb); where hb is my protocol , hb_tree will contain all my protocol relevant info ? pls correct me if wrong , thanks for your patience :)
The tree is where you hang your dissection items. The tvb* you are passed will contain the data for you to dissect, and offset 0 in it will contain the first byte of your protocol, the preceding dissectors having extracted their data payload into the tvb handed to you.