having trouble using heuristic dissector

"Saad Nader" <[email protected]>
Newsgroups gmane.network.ethereal.devel
Message-ID <[email protected]>
Hello,
I'm new to ethereal development and needed some help.  I have created a
heuristic dissector and associated it with all udp packets as follows:

// in the proto_reg_handoff _myproto, after checking initialized
// and creating the proto handle
heur_dissector_add("udp", heur_dissect_myproto, proto_myproto);

// The dissector looks like the following
// the previous ports:
static guint32 previous_src_port = -1;
static guint32 previous_dst_port = -1;
static gboolean heur_dissect_myproto(tvbuff_t *tvb, packet_info *pinfo,
                                                        proto_tree *tree)
{
    gshort myproto_head;
    guint8 myproto_packet_type;
    gint offset;

    offset = 0;
    // Check if there is really any data to parse!
    if (tvb_bytes_exist(tvb, 0, tvb_length_remaining(tvb, 0)) == FALSE)
        return FALSE;

    if (tvb_length_remaining(tvb, 0) < 5)
        return FALSE;

    // Check for the magic string and the type before parsing further
    myproto_head = tvb_get_ntohs(tvb, offset);

    if (myproto_head == MY_PROTO_HEAD)
        offset += 2;

    myproto_packet_type = tvb_get_guint8(tvb, offset);
    if (myproto_head == MY_PROTO_HEAD && myproto_packet_type <= 9)
    {
        previous_src_port = pinfo->srcport;
        previous_dst_port = pinfo->destport;
        call_dissector(myproto_handle, tvb, pinfo, tree);
        return TRUE;
    }
    else if (previous_src_port == pinfo->destport &&
             previous_dst_port == pinfo->srcport)
    {
        // I was never able to get the subtree working in the UI
        // with my original dissector.
        // however any packet that had the MY_PROTO_HEAD worked.
        // I guess during detailed information the static vars
        // get set to -1.  That might be why the detailed info
        // didn't show.
        previous_src_port = -1;         previous_dst_port = -1;
        call_dissector(myproto_handle, tvb, pinfo, tree);
        return TRUE;
    }

    return FALSE;

}

My question is why doesn't detailed information show for the else if
statement?  Should I just save the port off and add it as a filter, i.e.
dissector_add("udp.port", pinfo->destport, myproto_handle)?

_______________________________________________
Ethereal-dev mailing list
[email protected]
http://www.ethereal.com/mailman/listinfo/ethereal-dev
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.