Hi, I would like to build my own dissector based on the parameter severals values of cip.class. I used the function dissector_add_uint("cip.class",VALUE,handle), but it is not working. My dissector is never called. After research, I think it is because cip.class is not registered, right ? How can I do for use this parameter ? I see (by trying) that I can use cip.class.iface with value 0. But I don't know what is the attribute, it is never displayed and I don't find where it is read. Someone know where I can find this information ? Thanks, IJK asked 04 Feb '14, 07:06  IJK edited 04 Feb '14, 18:03  Guy Harris ♦♦ |
One Answer:
Hi, I think you are mixing filter names and dissector tables. To be able to register in a dissector table the table has to be registered first. You can find existing tables and what's registered in them in the "internals" menu in the top menubar. answered 05 Feb '14, 03:36  Anders ♦ |
