dissector_delete() is used only for the static dissector configuration, that is the per dissection session. If you need to do this per packet you should look into using heuristic dissectors. These return to the dissection engine whether or not they recognized the packet. If not the dissection engine passes the packet to the next one. In your case that would be the HTTP dissector. Make sure to set TCP dissector preference "Try heuristic sub-dissectors first"
answered 17 Mar '11, 00:06
Jaap ♦
11.7k●16●101
accept rate: 14%
I have a signature to detect my packet. If it is not present it should return back to the wireshark where it will decide which port it should go to. How can I do this? Thanks in advance