Hi, I am thinking to write a dissector. I saw an option to deliver it as an external plugin (https://code.wireshark.org/review/git...). I understand it is probably a less welcome option - OS compatibility issues and etc. But anyway if I will try to do it in the "plugin" way - will it be objected by the developers' community?
I don't know whether there will be a formal objection, but note the following issues:
I don't understand - does your answer (#1) means that core developers will not treat a plugin's code in the same way as they treat built-in dissectors? Then what happens in case API compatibility is broken in a plugin code in a new Wireshark version? Obviously the plugin will stop being compiled. And what, it will be removed from compilation/official installation?
N.B. It is absolutely clear that any code delivered in Wireshark project should be open-sourced and licensed under Wireshark's license
As @Guy Harris noted, in general the Wireshark Core Developers prefer C-based dissectors to be built-in as this eases the maintenance burden.
However, there are a number of plug-in dissectors within the Wireshark distribution so it's not entirely forbidden.
Why do you think making a plug-in would be best for your dissector?
It is just much easy to replace and update a plugin than re-compile the entire Wireshark code. Sometimes we have to add something or fix bugs in our dissector - it is much easy and quicker to compile and distribute a plugin. Say, you have a friend who is stuck with an older Wireshark version for some reason. In case of plugin dll you just send him updated dll, in case of built-in dissector you have nothing to do.
Your use case sounds ideal for a privately distributed dissector, but in that case you will be responsible for maintaining it (possibly with multiple versions) and distributing it along with the required installation instructions for the users.
For a core distributed dissector then the preferred option of built-in makes it easier for the core developers to maintain and distribute.
I don't understand - does your answer (#1) means that core developers will not treat a plugin's code in the same way as they treat built-in dissectors?
It means that third-party plugins may have to update their plugins - possibly with code changes, possibly just with recompilation - by themselves if they want them to work with future Wireshark releases.
The core developers treat built-in dissectors, and plugins that ship with Wireshark, differently from the way they treat third-party plugins, because the source code to the built-in dissectors and the plugins that ship with Wireshark are part of the Wireshark code base and are directly accessible to, and modifiable by, the core developers, while the source code to the third-party dissectors aren't.
Asked: 2019-10-31 20:11:48 +0000
Seen: 280 times
Last updated: Oct 31 '19
