This is our old Q&A Site. Please post any new questions and answers at

Hi everyone,

I am modifying a dissector plugin which used to work with wireshark version 1.10.

But when I try to compile it wireshark 1.12-rc2 source code, it throws error regarding a missing structure element:


Figured out that this element is no longer applicable for newer versions of wireshark. But I need to access the ethernet type from the packet I received. But the problem is, I am given the pointer buffer in the dissector just after the ethernet header. So cant use tvb_get_ptr.

I used the following 2 functions to add my dissector:

dissector_add_uint("ethertype", 0xABCD, xmax_handle);
dissector_add_uint("ethertype", 0xBDEF,_XMAX_UPLINK, xmax_handle);

My dissector is working properly with the above 2 packet types. But I need to access those 2 packet types (0xABCD and 0xBDEF) to do some internal processing.

So I went back to packet-ethertype.c to find out whats going on. Seems like this structure contains the packetype:


Can I pass this structure element to my dissector? I tried it, but gives segment fault.

Is there any other way to do it?

Thanks in advance.

asked 30 Jul '14, 13:20

kazi_hasan's gravatar image

accept rate: 0%

Create two handles (one for each of the ethertypes) each pointing to a different function and do dissector_add_uint separately for each ether type using the corresponding handle; Each of the separate functions can then call the common dissector code with a flag indicating the ethertype.

E.g., xmax_handle_abcd and xmax_handle_bdef

permanent link

answered 30 Jul '14, 13:30

Bill%20Meier's gravatar image

Bill Meier ♦♦
accept rate: 17%

edited 30 Jul '14, 13:35

Thanks for the reply. Actually I was thinking about this solution, but is there any way to access the packet type from the dissector itself?

(30 Jul '14, 13:36) kazi_hasan

A better/easier way is to use pinfo->match_uint. When your dissector is called because it is registered for a particular uint dissector-table value then this field is filled in with the matching value.

permanent link

answered 31 Jul '14, 06:29

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 30 Jul '14, 13:20

question was seen: 2,545 times

last updated: 31 Jul '14, 06:29

p​o​w​e​r​e​d by O​S​Q​A