Revision history [back]
What you should do is either:
- get an official
LINKTYPE_
value assigned for your link-layer packet type, by sending a message to [email protected], use that rather than 999, add an officialWTAP_ENCAP_
value for it inwiretap/wtap.h
, modifywiretap/pcap-common.c
to map theLINKTYPE_
value to theWTAP_ENCAP_
value, and have your dissector register in thewtap_encap
dissector table with theWTAP_ENCAP_
value;
or
- use one of the
LINKTYPE_USERn
values specifically reserved for private use (as per the list ofLINKTYPE_
values, those are values in the range 147 through 162), open up the Preferences dialog in Wireshark, open up Protocols in that dialog, selectDLT_USER
, and edit the Encapsulations Table and arrange that theLINKTYPE_USERn/DLT_USERn
value you used be dissected by your dissector.
The second of those is simpler, but doesn't guarantee that other users won't use the same LINKTYPE_USERn
value for a different type of link-layer header.
What you should do is either:
- get an official
LINKTYPE_ value assigned for your link-layer packet type, by sending a message to [email protected], use that rather than 999, add an officialLINKTYPE_
WTAP_ENCAP_ value for it inWTAP_ENCAP_
wiretap/wtap.h
, modifywiretap/pcap-common.c
to map theLINKTYPE_ value to theLINKTYPE_
WTAP_ENCAP_ value, and have your dissector register in theWTAP_ENCAP_
wtap_encap
dissector table with theWTAP_ENCAP_ value;WTAP_ENCAP_
or
- use one of the
LINKTYPE_USERn values specifically reserved for private use (as per the list ofLINKTYPE_USERn
LINKTYPE_ values, those are values in the range 147 through 162), open up the Preferences dialog in Wireshark, open up Protocols in that dialog, selectLINKTYPE_
DLT_USER, and edit the Encapsulations Table and arrange that theDLT_USER
,LINKTYPE_USERn/DLT_USERn value you used be dissected by your dissector.LINKTYPE_USERn/DLT_USERn
The second of those is simpler, but doesn't guarantee that other users won't use the same LINKTYPE_USERn value for a different type of link-layer header.LINKTYPE_USERn