Using UDP dest port as dissector handoff

Question

Hi, I am working on a dissector but I'm having trouble performing the handoff correctly. The packet in question is tunneled so I need to perform the handoff after the external headers. Right now I was able to get it to work by using the UDP dest port as a trigger, but I am wondering if that is a safe way to do it. Will any traffic going to the same UDP dest port be analyzed using this dissector then (including packets I may not want)?

dissector_add_uint("udp.port", 8099, juniper_vn_handle);

Accepted Answer

Will any traffic going to the same UDP dest port be analyzed using this dissector then (including packets I may not want)?

Yes, that would be the case. There is not concept of how much layering is applied then selecting the dissector (as you have noticed by the lack of any API parameter for this).

That stems from the fact the port numbers are/were intended to identify specific services at the various network hosts. Many still are present at their well known port numbers, but many more are present at the higher numbers. This is such a case. Therefor it's inevitable 'foreign protocol' may enter via this port number into your dissector.

There are two ways about it:

Setting up a conversation (based on IP addresses, port numbers and transport layer protocol)
Make a heuristic dissector (which determines on the start of the packet if the packet is indeed the of the expected protocol)