Re: How to avoid dissection based on port defined by a different dissector?

[Stephen Fisher <steve () stephen-fisher com>]

On Wed, Dec 15, 2010 at 03:02:31PM -0500, eymanm wrote:

> I have a dissector plugin that is registered with port A. Once in a 
> while, this dissector is not kicking in. It looks like it 
> "overpowered" by a dissector with registered port 3503 (lsp-ping). It 
> looks like port 3503 is defined in 
> epan\dissectors\packet-mpls-echo.c(39):#define UDP_PORT_MPLS_ECHO 
> 3503. Can somebody suggest how to avoid this trap?

In addition to Christopher Maynard's suggestions, the surest way to fix 
it is to make both dissectors "new-style" so that they verify that the 
traffic on the port they're registered on (3503) is the right traffic 
they're expecting and kick it back to Wireshark so that another 
dissector can be tried.  See README.developer in the doc directory for 
details on this.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe