Wireshark mailing list archives

Dissector for link layer to run before ethernet one


From: Mihai Cîrîc via Wireshark-dev <wireshark-dev () wireshark org>
Date: Thu, 20 Jul 2017 11:47:17 +0000 (UTC)

Hello all,
I have some capture files with packets encapsulated under ethernet. Butthese packets have a short header before the mac 
addresses and I amtrying to write a dissector that would run before the ethernet one,parse the header and then call the 
ethernet dissector to continue parsingthe rest of the packet.
I was not able to find any example of this being done and I guess it wouldinvolve changing the entry in the wtap_encap 
table to replace the ethdissector.
Any ideas on how this could be done?
All the best,
Mihai
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread: