> I.e., the H.225 dissector has to create TCP conversations and make the > H.245 dissector the dissector for them? (I infer from > I.e., it'd create conversations and associate RTP and RTCP with them, as > the RTSP dissector does?
Yep, the RTP/RTCP dissectors I wrote and are included in Ethereal (or at least used to, I haven't checked the latest version) do this. The H.245 dissector also works like that. > I'm not sure the RTP and RTCP dissectors are an issue - see how > "packet-rtsp.c" does it. It just gets handles for the RTP and RTCP > dissectors, and uses "conversation_set_dissector()". Can you do this from inside a plugin? > TPKT is both a dissector (for port 102, as per RFC 1006) and a set of > service routines for other dissectors to use. I know, I wrote the first implementation, but can I get to the service routines from inside a plugin? > It could, instead, allow subdissectors to register both "checking" and > "dissecting" routines - it'd have a list of "checking" routines, which > would be handed a tvbuff containing the TPKT payload and: Like MS Netmon has, right? > seem to show TPKT headers in a TCP segment by themselves, the heuristic > TPKT dissector should probably treat as the beginning of a TPKT PDU a > TCP segment that either That is implementation dependant. -- Andreas Sikkema
