Re: [Wireshark-dev] How to avoid dissection based on port defined by a different dissector?

[Christopher Maynard <Chris.Maynard () gtech com>]

eymanm <eymanm@...> writes:

> I have a dissector plugin that is registered with port A. Once in a while,
this dissector is not kicking in. It looks like it "overpowered" by a dissector
with registered port 3503 (lsp-ping). It looks like port 3503 is defined
in epan\dissectors\packet-mpls-echo.c(39):#define UDP_PORT_MPLS_ECHO 3503. Can
somebody suggest how to avoid this trap?

A couple of quick suggestions:
1) Change the other application/protocol so it avoids using any registered
ports.  See http://www.iana.org/assignments/port-numbers

2) Although this seems rather silly to me, you could change the MPLS Echo
dissector's registered port preference via Edit -> Preferences -> Protocols ->
MPLS Echo -> MPLS Echo UDP Port.

3) You can try disabling Wireshark's MPLS Echo dissector altogether via Analyze
-> Enabled Protocols -> MPLS Echo.

That other application/protocol might just end up using another registered port
though, so if you choose either 2 or 3 above, you could end up running into this
again with another one of Wireshark's dissectors.


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe