Ask Your Question

What is the community policy in respect of plugins?

asked 2019-10-31 20:11:48 +0000

Hi, I am thinking to write a dissector. I saw an option to deliver it as an external plugin ( I understand it is probably a less welcome option - OS compatibility issues and etc. But anyway if I will try to do it in the "plugin" way - will it be objected by the developers' community?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-10-31 20:35:32 +0000

Guy Harris gravatar image

I don't know whether there will be a formal objection, but note the following issues:

  1. Not only are there OS compatibility issues, there are also Wireshark compatibility issues - we don't guarantee API stability between major releases. If you submit your dissector as a built-in Wireshark dissector, the core developer community will update it as necessary for compatibility.
  2. We do require that plugins be GPL-licensed, which means you will need to make the source code available; we really don't want binary-only plugins, as that restricts the use of the plugin to particular operating systems and instruction sets.
  3. A Lua plugin should work on all OSes and instruction sets, and is less likely to be broken by API changes.
edit flag offensive delete link more


I don't understand - does your answer (#1) means that core developers will not treat a plugin's code in the same way as they treat built-in dissectors? Then what happens in case API compatibility is broken in a plugin code in a new Wireshark version? Obviously the plugin will stop being compiled. And what, it will be removed from compilation/official installation?

N.B. It is absolutely clear that any code delivered in Wireshark project should be open-sourced and licensed under Wireshark's license

alrod999 gravatar imagealrod999 ( 2019-11-02 16:26:24 +0000 )edit

As @Guy Harris noted, in general the Wireshark Core Developers prefer C-based dissectors to be built-in as this eases the maintenance burden.

However, there are a number of plug-in dissectors within the Wireshark distribution so it's not entirely forbidden.

Why do you think making a plug-in would be best for your dissector?

grahamb gravatar imagegrahamb ( 2019-11-03 11:11:52 +0000 )edit

It is just much easy to replace and update a plugin than re-compile the entire Wireshark code. Sometimes we have to add something or fix bugs in our dissector - it is much easy and quicker to compile and distribute a plugin. Say, you have a friend who is stuck with an older Wireshark version for some reason. In case of plugin dll you just send him updated dll, in case of built-in dissector you have nothing to do.

alrod999 gravatar imagealrod999 ( 2019-11-03 12:28:01 +0000 )edit

Your use case sounds ideal for a privately distributed dissector, but in that case you will be responsible for maintaining it (possibly with multiple versions) and distributing it along with the required installation instructions for the users.

For a core distributed dissector then the preferred option of built-in makes it easier for the core developers to maintain and distribute.

grahamb gravatar imagegrahamb ( 2019-11-03 19:11:54 +0000 )edit

I don't understand - does your answer (#1) means that core developers will not treat a plugin's code in the same way as they treat built-in dissectors?

It means that third-party plugins may have to update their plugins - possibly with code changes, possibly just with recompilation - by themselves if they want them to work with future Wireshark releases.

The core developers treat built-in dissectors, and plugins that ship with Wireshark, differently from the way they treat third-party plugins, because the source code to the built-in dissectors and the plugins that ship with Wireshark are part of the Wireshark code base and are directly accessible to, and modifiable by, the core developers, while the source code to the third-party dissectors aren't.

Guy Harris gravatar imageGuy Harris ( 2019-11-03 19:22:52 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-10-31 20:11:48 +0000

Seen: 251 times

Last updated: Oct 31 '19