This is our old Q&A Site. Please post any new questions and answers at

Hi, I am developing a new wireshark dissector. I have a pcap file the could be opened from wireshark how do I get my plugin to read this file. If I feed it through a port I can write the port to my dissector code to listen in that port. How does a plugin get activated when a pcap file is opened???

Thanks in Advance

asked 09 Jun '11, 13:01

tut087's gravatar image

accept rate: 0%

Dissectors don't read capture files; the core of Wireshark reads capture files, and calls the dissector for the link-layer header type for the packet, which then calls other dissectors.

Your dissector presumably dissects packets for a particular protocol; does that protocol run at the link layer, or does it run atop another protocol?

(09 Jun '11, 20:02) Guy Harris ♦♦

If you're having trouble integrating your plugin with Wireshark, then try reading README.developer and README.plugins in particular.

If your plugin is already compiled and integrated but it's just not getting handed packets that you think it should be handed, then you probably need to register your plugin on whichever UDP or TCP port your traffic is appearing on.

If the port can vary, then you might consider adding a port preference to your dissector so it's configurable. Alternatively, if the port could change frequently and it's too annoying to have to keep changing the port preference, you could try registering your plugin as a heuristic dissector instead. Refer to README.heuristic in that case.

permanent link

answered 09 Jun '11, 15:49

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

edited 09 Jun '11, 16:05

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 09 Jun '11, 13:01

question was seen: 4,068 times

last updated: 09 Jun '11, 20:02

p​o​w​e​r​e​d by O​S​Q​A