Wireshark mailing list archives

Recursive Heuristic Dissectors calls


From: Alex Lindberg <alindber () yahoo com>
Date: Wed, 5 Oct 2011 15:28:31 -0700 (PDT)

I have a custom protocol that uses a well know TCP port and a such have connected a heuristic dissector to tcp.

My dissector works fine if there is only my custom protocol in the packet, but I have run into a case where the first 
part of the packet has several groups of my protocol, but at the end is a normal h248 chunk of data.

How should I handle this?  I would like for the TCP dissector to try a heuristic dissector look up after each chuck of 
custom data.  After a quick look at the TCP dissector, it  appears that "dissector_try_heuristic", defined in 
epan/proto.c, is called only once per packet. 

Any ideas?  

Thanks as always.
Alex Lindberg
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread: