This is our old Q&A Site. Please post any new questions and answers at

Hi, I'm currently writing a Wireshark Dissector for a custom message. I'm trying to dissect the complete TCP Stream and am trying to implement tcp_dissect_pdus to solve this problem. I have the following functions:

 (Get foo message length function)
 1555     static guint 
 1556     get_foo_message_len(packet_info *pinfo _U_, tvbuff_t *tvb, int offset, void *data _U_)
 1557     {
 1558        return (guint)tvb_get_ntohl(tvb, offset+8);
 1559     }

     (dissect foo function)
 1562     static int 
 1563     dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
 1564     {
 1565       tcp_dissect_pdus(tvb, pinfo, tree, TRUE, 56, get_foo_message_len, 
 1566                        dissect_foo_message(tvb, pinfo, tree, data), data);
 1568       return tvb_captured_length(tvb);
 1569     }

 (dissect foo message function)
 1573     static int
 1574     dissect_foo_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_ )
 1575     {
 1576       guint32 size = tvb_captured_length(tvb);
 1577       guint32 offset = 0;
 1578       proto_item *ti = NULL;
 1579       proto_tree *hdr_tree = NULL;
 1580       proto_tree *second_tree = NULL;
 1641        return tvb_captured_length(tvb);
 1642     }

 (proto_reg_handoff_foo function)
 2942     void proto_reg_handoff_foo(void) {
 2943     //static dissector_handle_t foo_handle;
 2944     static dissector_handle_t foo_tcp_handle;

 2946     //foo_handle = create_dissector_handle(dissect_foo, proto_foo);
 2947     foo_tcp_handle = new_create_dissector_handle(dissect_foo, proto_foo);

 2949     //dissector_add_uint("tcp.port", FOO_PORT, foo_handle);
 2950     dissector_add_uint("tcp.port", FOO_PORT, foo_tcp_handle);
 2951     }

And I'm getting the following errors:

 packet-foo.c(1565) : error C2220: warning treated as error - no 'object' file generated
 packet-foo.c(1565) : warning C4013: 'dissect_foo_message' undefined; assuming extern returning int
 packet-foo.c(1565) : warning C4047: 'function' : 'new_dissector_t' differs in levels of indirection from 'int'
 packet-foo.c(1565) : warning C4024: 'tcp_dissect_pdus' : different types f
 or formal and actual parameter 7
 NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\BIN\amd64\cl.EXE"' : return code '0x2'
 NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\BIN\amd64\nmake.exe"' : return code '0x2'
 NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\BIN\amd64\nmake.exe"' : return code '0x2'

I'm currently running Windows 7 Enterprise, Visual Studio 2013 Pro, Qt 5.4, and working on Wireshark 1.99.7 Development Version.

I've used the Wireshark dissector.README file, the Developer's Guide, and various sites with information about how to use tcp_dissect_pdus and I haven't found any solution to this problem.

My main goal is to reassemble all the TCP packets and dissect them in technically one big packet since the data that's being sent in every packet is broken into several packets. And inside those several packets are various headers for the information. Each set of information can have a different length. It's just one giant packet broken into many smaller ones for transport.

Any type of information or advice can help.

Thank you for your time.

This question is marked "community wiki".

asked 30 Jul '15, 14:56

J1Ronnie's gravatar image

accept rate: 0%

edited 30 Jul '15, 15:01

This is a basic C issue of scope.

Either move the definition of the dissect_foo_message function before it's used in dissect_foo(), or add a forward declaration before its use.

In C, if you call a function before its been defined, or a forward declaration has been made, then the compiler assumes the function type is int func(void). As this is different from the type signature of the 7th parameter to tcp_dissect_pdus() which is new_dissector_t (from packet-tcp.h) which in turn is typedef int (*new_dissector_t)(tvbuff_t *, packet_info *, proto_tree *, void *) (from packet.h), then the errors you see are generated.

permanent link

answered 30 Jul '15, 15:37

grahamb's gravatar image

grahamb ♦
accept rate: 22%

Oh wow... that fixed it!!! Thank you!!!

(30 Jul '15, 15:46) J1Ronnie
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 30 Jul '15, 14:56

question was seen: 1,767 times

last updated: 30 Jul '15, 15:46

p​o​w​e​r​e​d by O​S​Q​A