This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am using eth heuristic dissector and my protocol relevant data will be part of ethernet payload and located at the end of ethernet payload. Now in dissect_myproto , the tvb pointer will directly/autonomously point to my protocol relevant data when my dissector gets called or i will have to manipulate it to point to my protocol relevant data and if yes then how ? ..

earlier my protocol relevant data was coming first thing in ethernet payload and i was dissecting it followed by call to call_dissector for ip for eg. :-

call_dissector(ip_handle,.... (inside diseector function) .. where ip_handle is ip_handle = find_dissector("ip");(inside reg_handoff)

But now my protocol relevant data is at end of eth payload so if i call call_dissector first for "eth" and then do my dissection , will it work ?

asked 05 Jun '12, 19:59

yogeshg's gravatar image

yogeshg
41222326
accept rate: 0%


The Ethernet dissector has an eth.trailer subdissector list which you can use. Have a look at the Ethernet dissector how this is called.

permanent link

answered 06 Jun '12, 01:14

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Is it possible anyhow that i can dissect http payload while having heuristic dissector of eth , normally i guess if we have eth heuristic dissector then tvb will point to eth payload but i want http payload which will effectively form last part of eth payload.

(06 Jun '12, 09:22) yogeshg
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×173

question asked: 05 Jun '12, 19:59

question was seen: 2,336 times

last updated: 06 Jun '12, 09:22

p​o​w​e​r​e​d by O​S​Q​A