Hi, I've written a dissector plugin to filter my protocolls. I've added dissector_add_uint("tcp.port", 5001, test_handle); to filter the port, but how can I add a filter of an ip adress? I tried something like dissector_add_string("ip.src", 127.0.0.1, test_handle); but this doesn't work. What is the correct way to add an ip to my dissector? asked 07 Feb '12, 10:09 Nic |
One Answer:
(A dissector doesn't filter protocols, it dissects them. Presumably that's what you meant.) Most dissector handoffs done with tables such as If you mean that you only want your dissector called for traffic to and from port 5001 that is coming from a particular IP address, the only way to do that would be to make a heuristic dissector and have it check both answered 07 Feb '12, 20:06 Guy Harris ♦♦ |