This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Dissector only processes first packet

0

I'm writing my first dissector based on the example in the Developers Guide and README.developer.

I register my dissector for a certain port using

dissector_add_uint("udp.port", FOO_PORT, handle);

I notice that it only gets applied to the first packet that matches the port and I can't apply it to other packets, not even using "Decode As".

How can I figure out what the problem might be ?

--- Update ---

I noticed my first packet is marked as "malformed" by the sub-dissector I'm calling. When run on other packets it works. How can I make my dissector ignore such errors so it will be applied to the following packets ? Is there some error flag I need to clear ?

asked 02 Nov '12, 08:00

Jan's gravatar image

Jan
6225
accept rate: 0%

edited 02 Nov '12, 09:12


One Answer:

0

As per your mailing list message, other packets in the capture are setting up an RTP session and Wireshark thinks your packets belong to that discussion. Future discussion will be on the wireshark-dev mailing list.

answered 02 Nov '12, 15:13

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%