why is Wireshark plugin locked to port 13000

[gmabey]

Hello,

I'm pretty new to Wireshark dissectors, but I thought that a dissector could match packets on their content, not just the port number that they are headed to.

So, I'm very surprised to find this line:

wireshark-vrtgen/packet-v49d2.c

Line 280 in 300886a

dissector_add_uint("udp.port", 13000, vrtgen_handle);

which seems to only match packets headed to port 13000. Isn't there a better way to do this?

Thank you for publishing this utility :-)

[shmahon]

Oops. Sorry. Was about to post a URL reference and fat fingered the close. I’ll ask one of the developers to respond in the morning. Reopening the question.

[gmabey]

Here's a refinement of this request/suggestion. I've found that is is possible to modify this particular parameter for the stock VITA49 dissector. I guess what I really want is to be able to set it without recompiling the .so ..


.

[jalbright-geon]

We don't mind adding the preferences API call to a future release of the dissector and that seems like an easy lift to modify the API call. We also like the idea of turning the plugin into a heuristic dissector, but again that would be a future enhancement. However, the plugin does not currently prevent you from listening to traffic on a different port. You can use this to decode incoming packets using a specific dissector - https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html#:~:text=Decode%20As%20is%20accessed%20by,Decode%20As%E2%80%9D%20dialog%20box%E2%80%9D.&text=In%20this%20dialog%20you%20are,edit%20buttons%20on%20the%20left. Hope this helps and allows you to not have to continue recompiling the plugin.