Wireshark mailing list archives
Dissector for link layer to run before ethernet one
From: Mihai Cîrîc via Wireshark-dev <wireshark-dev () wireshark org>
Date: Thu, 20 Jul 2017 11:47:17 +0000 (UTC)
Hello all, I have some capture files with packets encapsulated under ethernet. Butthese packets have a short header before the mac addresses and I amtrying to write a dissector that would run before the ethernet one,parse the header and then call the ethernet dissector to continue parsingthe rest of the packet. I was not able to find any example of this being done and I guess it wouldinvolve changing the entry in the wtap_encap table to replace the ethdissector. Any ideas on how this could be done? All the best, Mihai
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Dissector for link layer to run before ethernet one Mihai Cîrîc via Wireshark-dev (Jul 20)
- Re: Dissector for link layer to run before ethernet one John Thacker (Jul 20)
- Re: Dissector for link layer to run before ethernet one Roland Knall (Jul 20)
- Re: Dissector for link layer to run before ethernet one Guy Harris (Jul 20)