Ask Your Question
0

Dissector compatibility with various Wireshark versions

asked 2025-09-16 09:22:27 +0000

Trying to implement a dissector for Wireshark I faced trouble displaying my protocol name in COL_PROTOCOL column. Turned out the reason was that COL_PROTOCOL value passed to col_set_str was different from what my particular Wireshark version expected: Wireshark was 4.4.9 while API headers were for 4.7.something, and a new COL_* constant was added between the two versions.

As far as I could google, compatibility for plugins between various Wireshark versions is not guaranteed (and for the COL_* constants it is actually stated right in the source code that the values WILL change). This, however, poses a question.

Does that actually mean that for every user willing to view our protocol dissected (like a few dozens of them all over the country using different Wireshark versions) we’ll have to provide separate DLLs that should match particular user’s Wireshark version while being exactly the same inside? What’s even worse, the plugin is going to share the source code with software actually implementing the protocol, and the software is written in a different programming language than any of Wireshark-supported ones, so this basically means diffing every Wireshark version source code looking for possible inconsistencies introduced.

What actually is the Wireshark policy about this?

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2025-09-16 09:44:37 +0000

grahamb gravatar image

The policy is as noted, there is no guaranteed compatibility between versions, the project team do attempt to maintain compatibility within a release, e.g. 4.4.x.

The simplest way to manage this is to submit dissectors to the Wireshark project as a "C" built-in dissector and the Wireshark team will test and maintain things for you and, as a bonus, users will not have to guess which version of the plugin DLL they need.

If you want to keep the dissector as a separate project then the maintenance burden falls on you.

You should also take note of the Wireshark licence (https://www.gnu.org/licenses/old-lice...) and if distributing plugins to external users, ensure you comply with the licence, in particular availability of source code.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2025-09-16 09:22:27 +0000

Seen: 38 times

Last updated: 2 hours ago