How to write a dissector for a protocol that runs on top of TCP?

Question

void
proto_reg_handoff_foo(void)
{
    static dissector_handle_t foo_handle;
foo_handle = create_dissector_handle(dissect_foo, proto_foo);
dissector_add_uint(&quot;udp.port&quot;, FOO_PORT, foo_handle);

}

Here, shall i change “udp.port” as “tcp.port” for my tcp based application layer protocol dissector?

Answer 1

Yes, that should be all that's required.

Answer 2

UDP is a packet-oriented protocol, so packets for a protocol running atop UDP usually have a one-to-one correspondence with UDP packets.

TCP is a byte-stream oriented protocol, so packets for a protocol running atop TCP have to put their own packet boundaries into the byte stream, with, for example, a packet size field.

Dissectors for protocols running atop TCP just get handed TCP segment data, with no guarantee that they're being handed exactly one packet or that they're being handed all of the data in a packet. The dissector would have to handle that itself.

Depending on how your protocol does that, you might, for example, be able to use tcp_dissect_pdus() to do all the work. How does your protocol divide the byte stream into packets.