This is our old Q&A Site. Please post any new questions and answers at

My module is a postdissector for tcp packets that needs to be called sometime after the tcp dissector has done its bit. My proto_register_foo() and proto_reg_handoff_foo() functions are as given below:


static hf_register_info hf[] = {
static gint *ett[] = { ...

proto_foo = proto_register_protocol("Foo Protocol",   
    "FOO", "foo");    
register_dissector("foo", dissect_foo, proto_foo);  
proto_register_field_array(proto_foo, hf, array_length(hf));  
proto_register_subtree_array(ett, array_length(ett));


dissector_handle_t foo_handle;

tcp_orb_handle = find_dissector("foo");  
dissector_add_uint("ip.proto", IP_PROTO_TCP, foo_handle);  


The dissector is being called, but instead of being called at the end, it's being called before the tcp dissector. Worse, the tcp dissector is not being called at all! What mistake have I made here?

asked 05 Aug '12, 23:54

SidR's gravatar image

accept rate: 30%

You've registered the dissector as both a postdissector (register_postdissector()) and as a regular dissector taking all traffic on ip.proto==IP_PROTO_TCP. The latter means that your dissector is pre-empting the TCP dissector.

permanent link

answered 06 Aug '12, 05:59

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Thank you Jeff. That seems to be the case here.

(06 Aug '12, 20:55) SidR
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 05 Aug '12, 23:54

question was seen: 2,488 times

last updated: 06 Aug '12, 20:55

p​o​w​e​r​e​d by O​S​Q​A