Before writing the main part of a dissector the code that reads packets and organizes data into the GUI protocol tree some setup has to be done. Besides the logistical concerns of placing a dissector directly in Ethereal or making it a dynamically loadable plugin, you need to be familiar with the general layout of the code within a dissector source file. A registration step tells Ethereal about the dissector and plays a part in telling Ethereal when to call the dissector. Beyond that, there is much static information about the protocol that needs to be registered with Ethereal, including the fields, their descriptions, and some of their possible values.

Once a dissector is created, it must be called. The data in a packet is divided among different protocols. The beginning of a packet may contain an Ethernet header, followed by an Internet Protocol (IP) header, then a User Datagram Protocol (UDP) header, and finally, data specific to a certain program. The logic in Ethereal is similar to the layout of the protocol headers. The frame protocol dissector starts dissecting the packet, to show packet metadata in the Ethereal GUI. After that, the first "real" protocol dissector is called. After it does its dissection, the IP dissector is called, followed by the UDP dissector, and then any other dissector that might be applicable.

This arrangement of protocols is referred to as a stack, because one protocol is stacked on top of the other in the...