Hello. I observed a quite strange behaviour. If I disable dissectors over [Analyze->Enabled Protocols] panel, they still are registered on their BTP/UDP/TCP... ports in [Internals->Dissector tables->Integer tables]. Is it a bug or a feature? :-) Best regards Ewgenij asked 08 Jan '13, 06:41  Ewgenijkkg |
2 Answers:
This is a known bug. There was a discussion about it on the wireshark-dev mailing list last year, but no formal bug report has been opened for it yet. Feel free to open one. answered 08 Jan '13, 08:51  cmaynard ♦♦ edited 08 Jan '13, 08:52 |
A feature ... They are registered but disabled. (IOW: a dissector registered on a port but disabled is not called thus allowing another dissector (e.g., a heuristic dissector) to be called). The entries shown for disabled protocols should probably have an indication as being disabled. Feel free to file an enhancement request at bugs.wireshark.ord :) answered 08 Jan '13, 08:07  Bill Meier ♦♦ edited 08 Jan '13, 08:14 |
The problem is that no other dissector/plugin can register on these ports then! And that should be possible in my opinion. Disabled dissectors should not block anything...
I think a bit of thought and work might be required to do something like this.
As noted, feel free to file an enhancement request....
Done :) Thanks!
BR Ewgenij