This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm writing my first dissector based on the example in the Developers Guide and README.developer.

I register my dissector for a certain port using

dissector_add_uint("udp.port", FOO_PORT, handle);

I notice that it only gets applied to the first packet that matches the port and I can't apply it to other packets, not even using "Decode As".

How can I figure out what the problem might be ?

--- Update ---

I noticed my first packet is marked as "malformed" by the sub-dissector I'm calling. When run on other packets it works. How can I make my dissector ignore such errors so it will be applied to the following packets ? Is there some error flag I need to clear ?

asked 02 Nov '12, 08:00

Jan's gravatar image

Jan
6225
accept rate: 0%

edited 02 Nov '12, 09:12


As per your mailing list message, other packets in the capture are setting up an RTP session and Wireshark thinks your packets belong to that discussion. Future discussion will be on the wireshark-dev mailing list.

permanent link

answered 02 Nov '12, 15:13

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×637
×158
×23

question asked: 02 Nov '12, 08:00

question was seen: 1,998 times

last updated: 02 Nov '12, 15:13

p​o​w​e​r​e​d by O​S​Q​A