I solved it using WTAP_ENCAP_USER0. ..I think a better solution was it if i
could declare a really new "link type". But I think it is going well this way.
________________________________
Von: wireshark-dev-boun...@wireshark.org [wireshark-dev-boun...@wireshark.org]
im Auftrag von Lange Jan-Erik [jan-erik.la...@haw-hamburg.de]
Gesendet: Donnerstag, 18. November 2010 13:28
An: wireshark-dev@wireshark.org
Betreff: [Wireshark-dev] adding an encap_type_info element
Hello,
I want to dissect a packet that is not ethernet compliant. In the following I
decribe the strategy to realize this.
Can you tell me where I'm wrong?
1. I have to add a new encap_type_info element to the encap_table_base[] struct
in the wtap.c file.
/* WTAP_ENCAP_MYPHYLAYER */
{ "My Phy Layer", "myphylayer" },
2. In the wtap.h file I have to add a new #define element, ie.
#define WTAP_ENCAP_MYPHYLAYER 129
3. Now I can add the dissecor:
dissector_add("myphylayer", WTAP_ENCAP_MYPHYLAYER, myprot_handle);
Is this correct in general or are there points missing?
Best regards
Jan
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
