Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Hello, I have a use case where the data I need to dissect can be wrapped in couple different ways. The data can arrive in an ethernet packet with special ether-type (say, my-ethernet-type) or it can arrive in an IP packet with a special ip-protocol (say, my-ip-protocol). The payloads in both cases is exactly same.

I have written a built-in dissector for my-ip-protocol, and it works fine when data arrives in ip packets. ...

To dissect data that arrives in an ethernet frame with ether-type = my-ether-type, I have written the below lua script.

Is there some reason why you don't register your dissector in the "ethertype" dissector table, with the special EtherType as the key, and in the "ip.proto" dissector table, with the special IP protocol number as the key? That should work, if the payload is exactly the same.

I.e., your dissector would just be dissect_my_protocol(), and would be registered for both IP and EtherType-based protocols.