This is our old Q&A Site. Please post any new questions and answers at
    static dissector_handle_t foo_handle;

    foo_handle = create_dissector_handle(dissect_foo, proto_foo);
    dissector_add_uint("udp.port", FOO_PORT, foo_handle);

Here, shall i change "udp.port" as "tcp.port" for my tcp based application layer protocol dissector?

asked 11 Nov '11, 17:27

JK7's gravatar image

accept rate: 0%

edited 12 Nov '11, 13:29

Guy%20Harris's gravatar image

Guy Harris ♦♦

Yes, that should be all that's required.

permanent link

answered 12 Nov '11, 00:07

grahamb's gravatar image

grahamb ♦
accept rate: 22%

UDP is a packet-oriented protocol, so packets for a protocol running atop UDP usually have a one-to-one correspondence with UDP packets.

TCP is a byte-stream oriented protocol, so packets for a protocol running atop TCP have to put their own packet boundaries into the byte stream, with, for example, a packet size field.

Dissectors for protocols running atop TCP just get handed TCP segment data, with no guarantee that they're being handed exactly one packet or that they're being handed all of the data in a packet. The dissector would have to handle that itself.

Depending on how your protocol does that, you might, for example, be able to use tcp_dissect_pdus() to do all the work. How does your protocol divide the byte stream into packets.

permanent link

answered 12 Nov '11, 13:27

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

I think the OP is asking the question as the Developers Guide shows the "FOO" dissector as running atop UDP as per the example the OP has posted.

Your points are all worth noting though.

(12 Nov '11, 14:44) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 11 Nov '11, 17:27

question was seen: 3,201 times

last updated: 12 Nov '11, 14:44

p​o​w​e​r​e​d by O​S​Q​A