This is our old Q&A Site. Please post any new questions and answers at

How does Wireshark determine the style of dissector (new or old) ? For example the code below, how is "handle->is_new" true or false?

    /* This function will return
 * old style dissector :
 *   length of the payload or 1 of the payload is empty
 * new dissector :
 *   >0  this protocol was successfully dissected and this was this protocol.
 *   0   this packet did not match this protocol.
 * The only time this function will return 0 is if it is a new style dissector
 * and if the dissector rejected the packet.
call_dissector_through_handle(dissector_handle_t handle, tvbuff_t *tvb,
                  packet_info *pinfo, proto_tree *tree, void *data)


    if (handle->is_new) {
        EP_CHECK_CANARY(("before calling handle->dissector.new_d for %s",handle->name));
        ret = (*handle->dissector.new_d)(tvb, pinfo, tree, data);
        EP_CHECK_CANARY(("after calling handle->dissector.new_d for %s",handle->name));
    } else {
        EP_CHECK_CANARY(("before calling handle->dissector.old for %s",handle->name));
subdissector */
        (*handle->dissector.old)(tvb, pinfo, tree);
        EP_CHECK_CANARY(("after calling handle->dissector.old for %s",handle->name));
        ret = tvb_length(tvb);
        if (ret == 0) {
             * XXX - a tvbuff can have 0 bytes of data in
             * it, so we have to make sure we don't return
             * 0.
            ret = 1;

asked 13 May '15, 12:15

XQW1123's gravatar image

accept rate: 0%

edited 13 May '15, 12:17

handle->is_new is set depending on the function you call for the dissector registration: create_dissector_handle/register_dissector for old style and new_create_dissector_handle/new_register_dissector for new style.

permanent link

answered 13 May '15, 12:47

Pascal%20Quantin's gravatar image

Pascal Quantin
accept rate: 30%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 13 May '15, 12:15

question was seen: 882 times

last updated: 13 May '15, 12:47

p​o​w​e​r​e​d by O​S​Q​A