Ask Your Question

Revision history [back]

If none of the dissectors in the Wireshark instance (built-in, plugins or Lua based) can dissect the traffic, the "data" dissector is called as a last resort which just shows the traffic has hex bytes.

To add dissection for a new or "unknown" (it must be "known" to write a dissector) protocol requires a new dissector to be written. See the Wireshark Developers Guide for information on how to do that.