TABLE OF CONTENTS You will learn how to program your own protocol dissector, either linked into Ethereal or as a plugin.You will see how Ethereal calls your dissector and how to best integrate it into Ethereal. The various structures that you need to know about to retrieve your packet data and process it will be explained. Finally, some advanced topics are introduced that allow you to give your dissector even more functionality.
Before writing the main part of a dissector, the code that reads packets and organizes data into the GUI protocol tree, some setup has to be done. Besides the logistical concerns of placing your dissector directly in Ethereal or making it a dynamically loadable plugin, you need to be familiar with the general layout of the code within a dissector source file. There is a registration step, which tells Ethereal about your dissector and can play a part in telling Ethereal when to call your dissector. Beyond that, there is much static information about your protocol that needs to be registered with Ethereal: the fields, their descriptions, and even the possible values of some of them.
The first thing to decide when creating a new protocol dissector is how it will be integrated with Ethereal. Linking the dissector directly into the Ethereal binary allows a very quick start to development, but limits your options when distributing your dissector. Obviously, when linked with the Ethereal binary, your dissector can only be...
