This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, I have dissector which dissects the packet at port 80 but If its not my packet its not going to http dissector what should i do? please help. when do I use dissector_delete?

asked 16 Mar '11, 23:36

niks3089's gravatar image

niks3089
21151518
accept rate: 0%


dissector_delete() is used only for the static dissector configuration, that is the per dissection session. If you need to do this per packet you should look into using heuristic dissectors. These return to the dissection engine whether or not they recognized the packet. If not the dissection engine passes the packet to the next one. In your case that would be the HTTP dissector. Make sure to set TCP dissector preference "Try heuristic sub-dissectors first"

permanent link

answered 17 Mar '11, 00:06

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

I have a signature to detect my packet. If it is not present it should return back to the wireshark where it will decide which port it should go to. How can I do this? Thanks in advance

(17 Mar '11, 00:52) niks3089
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×293
×69
×2

question asked: 16 Mar '11, 23:36

question was seen: 2,706 times

last updated: 17 Mar '11, 00:52

p​o​w​e​r​e​d by O​S​Q​A