I have a TCP session consisting of multiple packets. When I select any one of them and say "Decode as..." for my dissector, the dissector is properly applied to all packets in the entire session. I can write a heuristic detector for my dissector that will match only the first packet in the sequence. However, when I do this, only the first packet is decoded by my dissector, and the remaining packets don't get dissected. Is it possible to tell the heuristic to apply the same dissector to all packets in the same TCP session? asked 23 May '13, 07:53  LouisDx edited 23 May '13, 07:53 |
One Answer:
once your heuristic kicks in you can set up a conversation and define your dissector as the conversation dissector. See conversation.h for the API and search the sources for examples (packet-sip, maybe). answered 23 May '13, 08:00  Anders ♦ edited 23 May '13, 08:16  grahamb ♦ |
That sounds promising -- thanks!
It worked, perfect!