| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Classes | Macros | Typedefs | Enumerations | Functions
General Packet Dissection

## Classes
struct | _guid_key
| Lookup key for GUID-indexed dissector tables, combining a GUID with an optional version field. More...
struct | heur_dtbl_entry
| Represents a single entry in a heuristic dissector table, binding a heuristic dissector to its protocol and configuration. More...
struct | frame_data_s
| Holds the data passed to the frame dissector for dissection of a single packet frame. More...
struct | file_data_s
| Holds the data passed to the file dissector for dissection of a capture file as a whole. More...
struct | ethertype_data_s
| Holds the parameters passed to the Ethertype dissector for dissecting an Ethernet payload. More...

## Macros
#define | hi_nibble(b)
#define | lo_nibble(b)
#define | BYTES_ARE_IN_FRAME(offset, captured_len, len)
#define | STRING_CASE_SENSITIVE 0
#define | STRING_CASE_INSENSITIVE 1

## Typedefs
typedef struct dissector_handle * | dissector_handle_t
typedef struct dissector_table * | dissector_table_t
typedef int(* | dissector_t) (tvbuff_t *, packet_info *, proto_tree *, void *)
typedef int(* | dissector_cb_t) (tvbuff_t *, packet_info *, proto_tree *, void *, void *)
typedef bool(* | heur_dissector_t) (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *)
typedef void(* | DATFunc) (const char *table_name, ftenum_t selector_type, void *key, void *value, void *user_data)
typedef void(* | DATFunc_handle) (const char *table_name, void *value, void *user_data)
typedef void(* | DATFunc_table) (const char *table_name, const char *ui_name, void *user_data)
typedef struct dtbl_entry | dtbl_entry_t
typedef struct _guid_key | guid_key
| Lookup key for GUID-indexed dissector tables, combining a GUID with an optional version field.
typedef struct heur_dissector_list * | heur_dissector_list_t
typedef struct heur_dtbl_entry | heur_dtbl_entry_t
| Represents a single entry in a heuristic dissector table, binding a heuristic dissector to its protocol and configuration.
typedef void(* | DATFunc_heur) (const char *table_name, struct heur_dtbl_entry *entry, void *user_data)
typedef void(* | DATFunc_heur_table) (const char *table_name, struct heur_dissector_list *table, void *user_data)
typedef struct depend_dissector_list * | depend_dissector_list_t
typedef struct frame_data_s | frame_data_t
| Holds the data passed to the frame dissector for dissection of a single packet frame.
typedef struct file_data_s | file_data_t
| Holds the data passed to the file dissector for dissection of a capture file as a whole.
typedef struct ethertype_data_s | ethertype_data_t
| Holds the parameters passed to the Ethertype dissector for dissecting an Ethernet payload.

## Enumerations
enum | heuristic_enable_e { HEURISTIC_DISABLE , HEURISTIC_ENABLE }
| Controls whether a heuristic dissector is active. More...
enum | data_source_media_type_e { DS_MEDIA_TYPE_APPLICATION_OCTET_STREAM , DS_MEDIA_TYPE_APPLICATION_JSON }
| MIME media type descriptor for a packet data source buffer. More...

## Functions
void | packet_init (void)
| Initialize the packet dissection engine.
void | packet_cache_proto_handles (void)
| Cache protocol handles for fast lookup during dissection.
void | packet_all_tables_sort_handles (void)
| Sort the dissector handles in all dissector tables.
void | packet_cleanup (void)
| Clean up the packet dissection engine.
WS_DLL_PUBLIC dissector_handle_t | dtbl_entry_get_handle (dtbl_entry_t *dtbl_entry)
| Return the currently active dissector handle for a dissector table entry.
WS_DLL_PUBLIC dissector_handle_t | dtbl_entry_get_initial_handle (dtbl_entry_t *entry)
| Return the initial (registered) dissector handle for a dissector table entry.
void | dissector_table_foreach_changed (const char *table_name, DATFunc func, void *user_data)
WS_DLL_PUBLIC void | dissector_table_foreach (const char *table_name, DATFunc func, void *user_data)
WS_DLL_PUBLIC void | dissector_all_tables_foreach_changed (DATFunc func, void *user_data)
WS_DLL_PUBLIC void | dissector_table_foreach_handle (const char *table_name, DATFunc_handle func, void *user_data)
WS_DLL_PUBLIC void | dissector_all_tables_foreach_table (DATFunc_table func, void *user_data, GCompareFunc compare_key_func)
WS_DLL_PUBLIC dissector_table_t | register_dissector_table (const char *name, const char *ui_name, const int proto, const ftenum_t type, const int param)
| a protocol uses the function to register a sub-dissector table
WS_DLL_PUBLIC dissector_table_t | register_custom_dissector_table (const char *name, const char *ui_name, const int proto, GHashFunc hash_func, GEqualFunc key_equal_func, GDestroyNotify key_destroy_func)
| Similar to register_dissector_table, but with a "custom" hash function to store subdissectors.
WS_DLL_PUBLIC void | register_dissector_table_alias (dissector_table_t dissector_table, const char *alias_name)
void | deregister_dissector_table (const char *name)
| Deregister the dissector table by table name.
WS_DLL_PUBLIC dissector_table_t | find_dissector_table (const char *name)
| Find a dissector table by its internal name.
WS_DLL_PUBLIC const char * | get_dissector_table_ui_name (const char *name)
| Return the UI display name for a dissector table.
WS_DLL_PUBLIC ftenum_t | get_dissector_table_selector_type (const char *name)
| Return the field type of the selector for a dissector table.
WS_DLL_PUBLIC int | get_dissector_table_param (const char *name)
| Return the parameter value associated with a dissector table.
WS_DLL_PUBLIC void | dissector_dump_dissector_tables (void)
| Print information about all registered dissector tables to standard output.
WS_DLL_PUBLIC void | dissector_add_uint (const char *name, const uint32_t pattern, dissector_handle_t handle)
| Add a uint-keyed entry to a dissector table.
WS_DLL_PUBLIC void | dissector_add_uint_with_preference (const char *name, const uint32_t pattern, dissector_handle_t handle)
| Add a uint-keyed entry to a dissector table and automatically register a corresponding user preference.
WS_DLL_PUBLIC void | dissector_add_uint_range (const char *abbrev, range_t *range, dissector_handle_t handle)
| Add a range of uint-keyed entries to a dissector table.
WS_DLL_PUBLIC void | dissector_add_uint_range_with_preference (const char *abbrev, const char *range_str, dissector_handle_t handle)
| Add a range of uint-keyed entries to a dissector table and automatically register a corresponding user preference.
WS_DLL_PUBLIC void | dissector_delete_uint (const char *name, const uint32_t pattern, dissector_handle_t handle)
| Remove the entry for a specific uint value from a dissector table.
WS_DLL_PUBLIC void | dissector_delete_uint_range (const char *abbrev, range_t *range, dissector_handle_t handle)
| Remove a range of uint-keyed entries from a dissector table.
WS_DLL_PUBLIC void | dissector_delete_all (const char *name, dissector_handle_t handle)
| Remove all entries for a given dissector handle from a table.
WS_DLL_PUBLIC void | dissector_change_uint (const char *abbrev, const uint32_t pattern, dissector_handle_t handle)
| Override the dissector for a uint value in a dissector table.
WS_DLL_PUBLIC void | dissector_reset_uint (const char *name, const uint32_t pattern)
| Reset a uint dissector table entry to its initial registered value.
WS_DLL_PUBLIC bool | dissector_is_uint_changed (dissector_table_t const sub_dissectors, const uint32_t uint_val)
| Return whether a uint dissector table entry has been overridden.
WS_DLL_PUBLIC int | dissector_try_uint (dissector_table_t sub_dissectors, const uint32_t uint_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
| Try to dissect using a uint-keyed dissector table entry.
WS_DLL_PUBLIC int | dissector_try_uint_with_data (dissector_table_t sub_dissectors, const uint32_t uint_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
| Try to dissect using a uint-keyed dissector table entry, with additional options and caller data.
WS_DLL_PUBLIC dissector_handle_t | dissector_get_uint_handle (dissector_table_t const sub_dissectors, const uint32_t uint_val)
WS_DLL_PUBLIC dissector_handle_t | dissector_get_default_uint_handle (const char *name, const uint32_t uint_val)
WS_DLL_PUBLIC void | dissector_add_string (const char *name, const char *pattern, dissector_handle_t handle)
| Add a string-keyed entry to a dissector table.
WS_DLL_PUBLIC void | dissector_delete_string (const char *name, const char *pattern, dissector_handle_t handle)
| Remove the entry for a specific string value from a dissector table.
WS_DLL_PUBLIC void | dissector_change_string (const char *name, const char *pattern, dissector_handle_t handle)
| Override the dissector for a string value in a dissector table.
WS_DLL_PUBLIC void | dissector_reset_string (const char *name, const char *pattern)
| Reset a string dissector table entry to its initial registered value.
WS_DLL_PUBLIC bool | dissector_is_string_changed (dissector_table_t const subdissectors, const char *string)
| Return whether a string dissector table entry has been overridden.
WS_DLL_PUBLIC int | dissector_try_string_with_data (dissector_table_t sub_dissectors, const char *string, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
| Look for a given string in a given dissector table and, if found, call the dissector with the arguments supplied, and return the number of bytes consumed, otherwise return 0.
WS_DLL_PUBLIC dissector_handle_t | dissector_get_string_handle (dissector_table_t sub_dissectors, const char *string)
WS_DLL_PUBLIC dissector_handle_t | dissector_get_default_string_handle (const char *name, const char *string)
WS_DLL_PUBLIC void | dissector_add_custom_table_handle (const char *name, void *pattern, dissector_handle_t handle)
| Add an entry to a "custom" dissector table.
WS_DLL_PUBLIC dissector_handle_t | dissector_get_custom_table_handle (dissector_table_t sub_dissectors, void *key)
WS_DLL_PUBLIC void | dissector_add_guid (const char *name, guid_key *guid_val, dissector_handle_t handle)
| Add an entry to a guid dissector table.
WS_DLL_PUBLIC int | dissector_try_guid_with_data (dissector_table_t sub_dissectors, guid_key *guid_val, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
| Look for a given value in a given guid dissector table and, if found, call the dissector with the arguments supplied, and return true, otherwise return false.
WS_DLL_PUBLIC void | dissector_delete_guid (const char *name, guid_key *guid_val, dissector_handle_t handle)
| Delete a GUID from a dissector table.
WS_DLL_PUBLIC dissector_handle_t | dissector_get_guid_handle (dissector_table_t const sub_dissectors, guid_key *guid_val)
WS_DLL_PUBLIC int | dissector_try_payload_with_data (dissector_table_t sub_dissectors, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, const bool add_proto_name, void *data)
| Invoke the currently assigned payload dissector for a dissector table.
WS_DLL_PUBLIC void | dissector_change_payload (const char *abbrev, dissector_handle_t handle)
| Override the payload dissector for an FT_NONE dissector table.
WS_DLL_PUBLIC void | dissector_reset_payload (const char *name)
| Reset an FT_NONE payload dissector table to its initial registered value.
WS_DLL_PUBLIC dissector_handle_t | dissector_get_payload_handle (dissector_table_t const dissector_table)
| Return the currently active dissector handle for a payload dissector table.
WS_DLL_PUBLIC void | dissector_add_for_decode_as (const char *name, dissector_handle_t handle)
| Register a dissector handle as a candidate for Decode As on a table.
WS_DLL_PUBLIC void | dissector_add_for_decode_as_with_preference (const char *name, dissector_handle_t handle)
| Same as dissector_add_for_decode_as(), but also registers a user preference for the dissector table value.
WS_DLL_PUBLIC GSList * | dissector_table_get_dissector_handles (dissector_table_t dissector_table)
| Return the list of all dissector handles registered with a table.
WS_DLL_PUBLIC dissector_handle_t | dissector_table_get_dissector_handle (dissector_table_t dissector_table, const char *description)
| Look up a dissector handle in a table by its description string.
WS_DLL_PUBLIC ftenum_t | dissector_table_get_type (dissector_table_t dissector_table)
| Return the selector field type of a dissector table.
WS_DLL_PUBLIC void | dissector_table_allow_decode_as (dissector_table_t dissector_table)
| Mark a dissector table as supporting Decode As.
void | dissector_table_allow_decode_as_internal (dissector_table_t dissector_table)
| Mark a dissector table as supporting Decode As.
WS_DLL_PUBLIC bool | dissector_table_supports_decode_as (dissector_table_t dissector_table)
| Return whether a dissector table supports Decode As.
WS_DLL_PUBLIC heur_dissector_list_t | register_heur_dissector_list_with_description (const char *name, const char *ui_name, const int proto)
WS_DLL_PUBLIC const char * | heur_dissector_list_get_description (heur_dissector_list_t list)
WS_DLL_PUBLIC heur_dissector_list_t | register_heur_dissector_list (const char *name, const int proto)
void | deregister_heur_dissector_list (const char *name)
WS_DLL_PUBLIC void | heur_dissector_table_foreach (const char *table_name, DATFunc_heur func, void *user_data)
WS_DLL_PUBLIC void | dissector_all_heur_tables_foreach_table (DATFunc_heur_table func, void *user_data, GCompareFunc compare_key_func)
WS_DLL_PUBLIC bool | has_heur_dissector_list (const char *name)
| Check if a heuristic dissector list of the given name exists.
WS_DLL_PUBLIC bool | dissector_try_heuristic (heur_dissector_list_t sub_dissectors, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, heur_dtbl_entry_t **hdtbl_entry, void *data)
WS_DLL_PUBLIC heur_dissector_list_t | find_heur_dissector_list (const char *name)
WS_DLL_PUBLIC heur_dtbl_entry_t * | find_heur_dissector_by_unique_short_name (const char *short_name)
WS_DLL_PUBLIC void | heur_dissector_add (const char *name, heur_dissector_t dissector, const char *display_name, const char *internal_name, const int proto, heuristic_enable_e enable)
WS_DLL_PUBLIC void | heur_dissector_delete (const char *name, heur_dissector_t dissector, const int proto)
WS_DLL_PUBLIC dissector_handle_t | register_dissector (const char *name, dissector_t dissector, const int proto)
| Register a new dissector with the global dissector registry.
WS_DLL_PUBLIC dissector_handle_t | register_dissector_with_description (const char *name, const char *description, dissector_t dissector, const int proto)
| Register a new dissector with a custom user-visible description.
WS_DLL_PUBLIC dissector_handle_t | register_dissector_with_data (const char *name, dissector_cb_t dissector, const int proto, void *cb_data)
| Register a new dissector that carries an opaque callback pointer.
void | deregister_dissector (const char *name)
| Deregister a previously registered dissector.
WS_DLL_PUBLIC const char * | dissector_handle_get_protocol_long_name (const dissector_handle_t handle)
| Return the long (full) protocol name for a dissector handle.
WS_DLL_PUBLIC const char * | dissector_handle_get_protocol_short_name (const dissector_handle_t handle)
| Return the short protocol name for a dissector handle.
WS_DLL_PUBLIC const char * | dissector_handle_get_description (const dissector_handle_t handle)
| Return the user-visible description for a dissector handle.
WS_DLL_PUBLIC int | dissector_handle_get_protocol_index (const dissector_handle_t handle)
| Return the protocol index for a dissector handle.
WS_DLL_PUBLIC GList * | get_dissector_names (void)
| Return a GList of all registered dissector name strings.
WS_DLL_PUBLIC dissector_handle_t | find_dissector (const char *name)
| Find a registered dissector by name.
WS_DLL_PUBLIC dissector_handle_t | find_dissector_add_dependency (const char *name, const int parent_proto)
| Find a registered dissector by name and record a protocol dependency.
WS_DLL_PUBLIC const char * | dissector_handle_get_dissector_name (const dissector_handle_t handle)
| Return the registered name of a dissector from its handle.
WS_DLL_PUBLIC const char * | dissector_handle_get_pref_suffix (const dissector_handle_t handle)
| Return the preferences suffix string for a dissector handle.
WS_DLL_PUBLIC dissector_handle_t | create_dissector_handle (dissector_t dissector, const int proto)
| Create an anonymous, unregistered dissector handle.
WS_DLL_PUBLIC dissector_handle_t | create_dissector_handle_with_name (dissector_t dissector, const int proto, const char *name)
| Create a named, unregistered dissector handle.
WS_DLL_PUBLIC dissector_handle_t | create_dissector_handle_with_name_and_description (dissector_t dissector, const int proto, const char *name, const char *description)
WS_DLL_PUBLIC dissector_handle_t | create_dissector_handle_with_data (dissector_cb_t dissector, const int proto, void *cb_data)
| Create an anonymous, unregistered callback-style dissector handle.
WS_DLL_PUBLIC void | dissector_dump_dissectors (void)
| Dump all registered dissectors to the standard output.
WS_DLL_PUBLIC int | call_dissector_with_data (dissector_handle_t handle, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
| Call a dissector through a handle and if no dissector was found pass it over to the "data" dissector instead.
WS_DLL_PUBLIC int | call_dissector (dissector_handle_t handle, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
| Call a dissector through its handle, falling back to the data dissector.
WS_DLL_PUBLIC int | call_data_dissector (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
| Call a data dissector.
WS_DLL_PUBLIC int | call_dissector_only (dissector_handle_t handle, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
WS_DLL_PUBLIC void | call_heur_dissector_direct (heur_dtbl_entry_t *heur_dtbl_entry, tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
WS_DLL_PUBLIC bool | register_depend_dissector (const char *parent, const char *dependent)
WS_DLL_PUBLIC bool | deregister_depend_dissector (const char *parent, const char *dependent)
WS_DLL_PUBLIC depend_dissector_list_t | find_depend_dissector_list (const char *name)
WS_DLL_PUBLIC void | set_actual_length (tvbuff_t *tvb, const unsigned specified_len)
| Given a tvbuff, and a length from a packet header, adjust the length of the tvbuff to reflect the specified length.
WS_DLL_PUBLIC void | register_init_routine (void(*func)(void))
WS_DLL_PUBLIC void | register_cleanup_routine (void(*func)(void))
WS_DLL_PUBLIC void | register_shutdown_routine (void(*func)(void))
void | init_dissection (const char *app_env_var_prefix)
| Initialize all data structures used for dissection.
void | cleanup_dissection (void)
| Free data structures allocated for dissection.
WS_DLL_PUBLIC void | register_postseq_cleanup_routine (void(*func)(void))
| Allow protocols to register a "cleanup" routine to be run after the initial sequential run through the packets. Note that the file can still be open after this; this is not the final cleanup.
WS_DLL_PUBLIC void | postseq_cleanup_all_protocols (void)
| Call all the registered "postseq_cleanup" routines.
WS_DLL_PUBLIC void | register_final_registration_routine (void(*func)(void))
void | final_registration_all_protocols (void)
| Call all the registered "final_registration" routines.
WS_DLL_PUBLIC struct data_source * | add_new_data_source (packet_info *pinfo, tvbuff_t *tvb, const char *name)
WS_DLL_PUBLIC void | set_data_source_name (packet_info *pinfo, struct data_source *src, const char *name)
WS_DLL_PUBLIC void | set_data_source_media_type (struct data_source *src, data_source_media_type_e media_type)
WS_DLL_PUBLIC void | remove_last_data_source (packet_info *pinfo)
| Remove the most recently added data source from a packet.
WS_DLL_PUBLIC const char * | get_data_source_name (const struct data_source *src)
| Return the display name of a data source.
WS_DLL_PUBLIC char * | get_data_source_description (const struct data_source *src)
| Return the description of a data source.
WS_DLL_PUBLIC tvbuff_t * | get_data_source_tvb (const struct data_source *src)
| Return the tvbuff associated with a data source.
WS_DLL_PUBLIC struct data_source * | get_data_source_by_name (const packet_info *pinfo, const char *name)
WS_DLL_PUBLIC struct data_source * | get_data_source_by_tvb (const packet_info *pinfo, const tvbuff_t *tvb)
WS_DLL_PUBLIC int32_t | get_data_source_index_by_tvb (const packet_info *pinfo, const tvbuff_t *tvb)
WS_DLL_PUBLIC data_source_media_type_e | get_data_source_media_type (const struct data_source *src)
void | free_data_sources (packet_info *pinfo)
| Free up a frame's list of data sources.
WS_DLL_PUBLIC void | mark_frame_as_depended_upon (frame_data *fd, uint32_t frame_num)
| Mark another frame as depended upon by the current frame.
void | dissect_record (struct epan_dissect *edt, int file_type_subtype, wtap_rec *rec, frame_data *fd, column_info *cinfo)
| Dissectors should never modify the record data.
void | dissect_file (struct epan_dissect *edt, wtap_rec *rec, frame_data *fd, column_info *cinfo)
| Dissectors should never modify the file data.
WS_DLL_PUBLIC void | dissector_dump_decodes (void)
| Dump layer/selector/dissector records in a fashion similar to the proto_registrar_dump_* routines.
WS_DLL_PUBLIC void | dissector_dump_heur_decodes (void)
| For each heuristic dissector table, dump list of dissectors (filter_names) for that table.
WS_DLL_PUBLIC void | register_postdissector (dissector_handle_t handle)
| Register a postdissector; the argument is the dissector handle for it.
WS_DLL_PUBLIC void | set_postdissector_wanted_hfids (dissector_handle_t handle, GArray *wanted_hfids)
void | deregister_postdissector (dissector_handle_t handle)
| Deregister a postdissector. Not for use in (post)dissectors or applications; only to be used by libwireshark itself.
bool | have_postdissector (void)
| Return whether any postdissectors are registered.
void | call_all_postdissectors (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
| Invoke all registered postdissectors on the current frame.
WS_DLL_PUBLIC bool | postdissectors_want_hfids (void)
| Return whether any postdissector has requested specific hfids.
void | prime_epan_dissect_with_postdissector_wanted_hfids (epan_dissect_t *edt)
| Prime an epan_dissect_t with all hfids requested by postdissectors.
WS_DLL_PUBLIC void | increment_dissection_depth (packet_info *pinfo)
WS_DLL_PUBLIC void | increment_dissection_depth_by_n (packet_info *pinfo, unsigned n)
WS_DLL_PUBLIC void | decrement_dissection_depth (packet_info *pinfo)
| Decrement the dissection depth.
WS_DLL_PUBLIC void | decrement_dissection_depth_by_n (packet_info *pinfo, unsigned n)
| Decrement the dissection depth by a value.

## Detailed Description

## Macro Definition Documentation

## ◆ BYTES_ARE_IN_FRAME

#define BYTES_ARE_IN_FRAME | ( |  | offset,
|  |  | captured_len,
|  |  | len )

Value:
((unsigned)(offset) + (unsigned)(len) > (unsigned)(offset) && \
(unsigned)(offset) + (unsigned)(len) <= (unsigned)(captured_len))

## ◆ hi_nibble

#define hi_nibble | ( |  | b | ) |

Value:
(((b) & 0xf0) >> 4)

## ◆ lo_nibble

#define lo_nibble | ( |  | b | ) |

Value:
((b) & 0x0f)

## Typedef Documentation

## ◆ guid_key

typedef struct _guid_key guid_key

Lookup key for GUID-indexed dissector tables, combining a GUID with an optional version field.

Based on DCE/RPC requirements; some dissector tables may not use the ver field.

## ◆ heur_dissector_t

typedef bool(* heur_dissector_t) (tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *)

Type of a heuristic dissector, used in heur_dissector_add().

Parameters

  tvb | the tvbuff with the (remaining) packet data
  pinfo | the packet info of this packet (additional info)
  tree | the protocol tree to be build or NULL

Returns
  true if the packet was recognized by the sub-dissector (stop dissection here)

## Enumeration Type Documentation

## ◆ data_source_media_type_e

enum data_source_media_type_e

MIME media type descriptor for a packet data source buffer.

Enumerator
DS_MEDIA_TYPE_APPLICATION_OCTET_STREAM | Raw binary data (application/octet-stream)
DS_MEDIA_TYPE_APPLICATION_JSON | JSON-encoded data (application/json)

## ◆ heuristic_enable_e

enum heuristic_enable_e

Controls whether a heuristic dissector is active.

Enumerator
HEURISTIC_DISABLE | Heuristic dissector is disabled and will not be invoked
HEURISTIC_ENABLE | Heuristic dissector is enabled and may be invoked for matching traffic

## Function Documentation

## ◆ add_new_data_source()

WS_DLL_PUBLIC struct data_source * add_new_data_source | ( | packet_info * | pinfo,
|  | tvbuff_t * | tvb,
|  | const char * | name )

Add a new data source to the list of data sources for a frame, given the tvbuff for the data source and its name. The media type will be set to DS_MEDIA_TYPE_APPLICATION_OCTET_STREAM.

Parameters

  pinfo | Packet info.
  tvb | The tvbuff to associate with the data source.
  name | A display-friendly name of the data source.

Returns
  An opaque pointer to the data source.

## ◆ call_all_postdissectors()

void call_all_postdissectors | ( | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree )
| extern

Invoke all registered postdissectors on the current frame.

Iterates over every registered postdissector and calls each one with the supplied packet buffer, packet info, and protocol tree. Postdissectors run after all regular dissectors have completed for a given frame.

Note
  Internal to libwireshark. Not for use by dissectors or applications.

Parameters

  tvb | The packet buffer for the current frame.
  pinfo | The packet info for the current frame.
  tree | The fully populated protocol tree for the current frame.

## ◆ call_data_dissector()

WS_DLL_PUBLIC int call_data_dissector | ( | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree )

Call a data dissector.

Parameters

  tvb | The buffer to dissect.
  pinfo | Packet Info.
  tree | The protocol tree.

Returns
  0 if the data dissector did not consume any bytes, otherwise the number of bytes consumed.

## ◆ call_dissector()

WS_DLL_PUBLIC int call_dissector | ( | dissector_handle_t | handle,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree )

Call a dissector through its handle, falling back to the data dissector.

Parameters

  handle | The handle of the dissector to invoke.
  tvb | The buffer containing the payload to dissect.
  pinfo | Packet metadata and column information.
  tree | The protocol tree node under which the child dissector should add its items.

Returns
  The number of bytes consumed by the dissector, or the number consumed by the data dissector fallback if the primary dissector declined. A return value equal to `tvb_captured_length(tvb)` indicates the entire buffer was consumed.

## ◆ call_dissector_only()

WS_DLL_PUBLIC int call_dissector_only | ( | dissector_handle_t | handle,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | void * | data )

Call a dissector through a handle but if no dissector was found just return 0 and do not call the "data" dissector instead.

Parameters

  handle | The dissector to call.
  tvb | The buffer to dissect.
  pinfo | Packet Info.
  tree | The protocol tree.
  data | parameter to pass to dissector

Returns
  If the protocol for that handle isn't enabled, return 0 without calling the dissector. Otherwise, if the handle refers to a new-style dissector, call the dissector and return its return value, otherwise call it and return the length of the tvbuff pointed to by the argument.

## ◆ call_dissector_with_data()

WS_DLL_PUBLIC int call_dissector_with_data | ( | dissector_handle_t | handle,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | void * | data )

Call a dissector through a handle and if no dissector was found pass it over to the "data" dissector instead.

Parameters

  handle | The dissector to call.
  tvb | The buffer to dissect.
  pinfo | Packet Info.
  tree | The protocol tree.
  data | parameter to pass to dissector

Returns
  If the protocol for that handle isn't enabled call the data dissector. Otherwise, if the handle refers to a new-style dissector, call the dissector and return its return value, otherwise call it and return the length of the tvbuff pointed to by the argument.

## ◆ call_heur_dissector_direct()

WS_DLL_PUBLIC void call_heur_dissector_direct | ( | heur_dtbl_entry_t * | heur_dtbl_entry,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | void * | data )

Parameters

  heur_dtbl_entry | The heur_dtbl_entry of the dissector to call.
  tvb | The buffer to dissect.
  pinfo | Packet Info.
  tree | The protocol tree.
  data | parameter to pass to dissector

## ◆ create_dissector_handle()

WS_DLL_PUBLIC dissector_handle_t create_dissector_handle | ( | dissector_t | dissector,
|  | const int | proto )

Create an anonymous, unregistered dissector handle.

Unregistered means that other dissectors can't find the dissector through this API. The typical use case is dissectors added to dissector tables that shouldn't be called by other dissectors, perhaps if some data structure must be passed to the dissector.

Parameters

  dissector | The dissector the handle will call
  proto | The value obtained when registering the protocol

Note
  The protocol short name will be used as the user-visible description.

## ◆ create_dissector_handle_with_data()

WS_DLL_PUBLIC dissector_handle_t create_dissector_handle_with_data | ( | dissector_cb_t | dissector,
|  | const int | proto,
|  | void * | cb_data )

Create an anonymous, unregistered callback-style dissector handle.

Like create_dissector_handle(), but uses the `dissector_cb_t` calling convention so that `cb_data` is forwarded to the dissector on every invocation. The handle is not added to the global registry.

Parameters

  dissector | The callback-style dissector function the handle will invoke.
  proto | Protocol index returned by `proto_register_protocol()`.
  cb_data | Opaque pointer passed through to `dissector` on each call.

Returns
  A newly created, unregistered `dissector_handle_t`.

## ◆ create_dissector_handle_with_name()

WS_DLL_PUBLIC dissector_handle_t create_dissector_handle_with_name | ( | dissector_t | dissector,
|  | const int | proto,
|  | const char * | name )

Create a named, unregistered dissector handle.

Create an named, unregistered dissector handle. A non-NULL name is needed for dissector_add_for_decode_add_with_preference().

Note
  The protocol short name will be used as the user-visible description.

Parameters

  dissector | The dissector the handle will call
  proto | The value obtained when registering the protocol
  name | a short, machine-friendly name for the dissector. Does not have to be globally unique, but should be unique for any table the handle will be registered to. Can be NULL, which creates an anonymous dissector.

Returns
  A newly created, unregistered `dissector_handle_t`.

## ◆ create_dissector_handle_with_name_and_description()

WS_DLL_PUBLIC dissector_handle_t create_dissector_handle_with_name_and_description | ( | dissector_t | dissector,
|  | const int | proto,
|  | const char * | name,
|  | const char * | description )

Create an named, unregistered handle dissector handle with a description. A non-NULL name is needed for dissector_add_for_decode_add_with_preference(). The description is used to allow a user to distinguish dissectors for the same protocol, e.g. when registered to the same table.

Parameters

  dissector | The dissector the handle will call
  proto | The value obtained when registering the protocol
  name | a short, machine-friendly name for the dissector. Does not have to be globally unique, but should be unique for any table the handle will be registered to. Can be NULL, which creates an anonymous dissector.
  description | Freeform text designed to be shown to a user. Must be unique for any table the dissector is registered in. Can be NULL, in which case the protocol short name is used as the user-visible description.

## ◆ decrement_dissection_depth()

WS_DLL_PUBLIC void decrement_dissection_depth | ( | packet_info * | pinfo | ) |

Decrement the dissection depth.

Parameters

  pinfo | Packet Info.

## ◆ decrement_dissection_depth_by_n()

WS_DLL_PUBLIC void decrement_dissection_depth_by_n | ( | packet_info * | pinfo,
|  | unsigned | n )

Decrement the dissection depth by a value.

Parameters

  pinfo | Packet Info.
  n | The value by which to decrement the depth

## ◆ deregister_depend_dissector()

WS_DLL_PUBLIC bool deregister_depend_dissector | ( | const char * | parent,
|  | const char * | dependent )

Unregister a protocol dependency This is done automatically when removing from a dissector or heuristic table. This is for "manual" deregistration for things like Lua.

Parameters

  parent | "Parent" protocol short name
  dependent | "Dependent" protocol short name

Returns
  return true if dependency was successfully unregistered

## ◆ deregister_dissector()

void deregister_dissector | ( | const char * | name | ) |

Deregister a previously registered dissector.

Parameters

  name | The name passed to register_dissector() at registration time.

## ◆ deregister_dissector_table()

void deregister_dissector_table | ( | const char * | name | ) |

Deregister the dissector table by table name.

Parameters

  name | The name of the dissector table to deregister.

## ◆ deregister_heur_dissector_list()

void deregister_heur_dissector_list | ( | const char * | name | ) |

Deregister a heuristic dissector list by unique short name.

## ◆ deregister_postdissector()

void deregister_postdissector | ( | dissector_handle_t | handle | ) |

Deregister a postdissector. Not for use in (post)dissectors or applications; only to be used by libwireshark itself.

Parameters

  handle | The dissector handle for the postdissector to deregister.

## ◆ dissect_file()

void dissect_file | ( | struct epan_dissect * | edt,
|  | wtap_rec * | rec,
|  | frame_data * | fd,
|  | column_info * | cinfo )
| extern

Dissectors should never modify the file data.

Parameters

  edt | The epan_dissect_t for the current dissection.
  rec | The record for the current frame.
  fd | The frame data for the current frame.
  cinfo | The column info for the current frame.

## ◆ dissect_record()

void dissect_record | ( | struct epan_dissect * | edt,
|  | int | file_type_subtype,
|  | wtap_rec * | rec,
|  | frame_data * | fd,
|  | column_info * | cinfo )
| extern

Dissectors should never modify the record data.

Parameters

  edt | The epan_dissect_t for the current dissection.
  file_type_subtype | The file type subtype of the current frame.
  rec | The record for the current frame.
  fd | The frame data for the current frame.
  cinfo | The column info for the current frame.

< time stamp

## ◆ dissector_add_custom_table_handle()

WS_DLL_PUBLIC void dissector_add_custom_table_handle | ( | const char * | name,
|  | void * | pattern,
|  | dissector_handle_t | handle )

Add an entry to a "custom" dissector table.

Parameters

  name | The name of the dissector table.
  pattern | The pattern to match.
  handle | The dissector handle to associate with the pattern.

## ◆ dissector_add_for_decode_as()

WS_DLL_PUBLIC void dissector_add_for_decode_as | ( | const char * | name,
|  | dissector_handle_t | handle )

Register a dissector handle as a candidate for Decode As on a table.

Adds `handle` to the list of dissectors that the user may select when using Decode As or the `-d` command-line option, without binding it to a specific key value.

Parameters

  name | The internal name of the dissector table.
  handle | The dissector handle to make available for Decode As.

## ◆ dissector_add_for_decode_as_with_preference()

WS_DLL_PUBLIC void dissector_add_for_decode_as_with_preference | ( | const char * | name,
|  | dissector_handle_t | handle )

Same as dissector_add_for_decode_as(), but also registers a user preference for the dissector table value.

Parameters

  name | The internal name of the dissector table.
  handle | The dissector handle to make available for Decode As.

## ◆ dissector_add_guid()

WS_DLL_PUBLIC void dissector_add_guid | ( | const char * | name,
|  | guid_key * | guid_val,
|  | dissector_handle_t | handle )

Add an entry to a guid dissector table.

Parameters

  name | The name of the dissector table.
  guid_val | The GUID value to add.
  handle | The dissector handle to associate with the GUID.

## ◆ dissector_add_string()

WS_DLL_PUBLIC void dissector_add_string | ( | const char * | name,
|  | const char * | pattern,
|  | dissector_handle_t | handle )

Add a string-keyed entry to a dissector table.

Parameters

  name | The internal name of the dissector table.
  pattern | The string selector value to register.
  handle | The dissector handle to associate with `pattern`.

## ◆ dissector_add_uint()

WS_DLL_PUBLIC void dissector_add_uint | ( | const char * | name,
|  | const uint32_t | pattern,
|  | dissector_handle_t | handle )

Add a uint-keyed entry to a dissector table.

Parameters

  name | The internal name of the dissector table.
  pattern | The uint selector value to register.
  handle | The dissector handle to associate with `pattern`.

## ◆ dissector_add_uint_range()

WS_DLL_PUBLIC void dissector_add_uint_range | ( | const char * | abbrev,
|  | range_t * | range,
|  | dissector_handle_t | handle )

Add a range of uint-keyed entries to a dissector table.

Parameters

  abbrev | The internal name of the dissector table.
  range | The range of uint selector values to register.
  handle | The dissector handle to associate with each value in `range`.

## ◆ dissector_add_uint_range_with_preference()

WS_DLL_PUBLIC void dissector_add_uint_range_with_preference | ( | const char * | abbrev,
|  | const char * | range_str,
|  | dissector_handle_t | handle )

Add a range of uint-keyed entries to a dissector table and automatically register a corresponding user preference.

Parameters

  abbrev | The internal name of the dissector table.
  range_str | The default range string for the registered preference.
  handle | The dissector handle to associate with the range.

## ◆ dissector_add_uint_with_preference()

WS_DLL_PUBLIC void dissector_add_uint_with_preference | ( | const char * | name,
|  | const uint32_t | pattern,
|  | dissector_handle_t | handle )

Add a uint-keyed entry to a dissector table and automatically register a corresponding user preference.

Parameters

  name | The internal name of the dissector table.
  pattern | The uint selector value to register.
  handle | The dissector handle to associate with `pattern`.

## ◆ dissector_all_heur_tables_foreach_table()

WS_DLL_PUBLIC void dissector_all_heur_tables_foreach_table | ( | DATFunc_heur_table | func,
|  | void * | user_data,
|  | GCompareFunc | compare_key_func )

Iterate over all heuristic dissector tables.

Walk the set of heuristic dissector tables calling a user supplied function on each table.

Parameters

  [in] | func | The function to call for each table.
  [in] | user_data | User data to pass to the function.
  [in] | compare_key_func | Function used to sort the set of tables before calling the function. No sorting is done if NULL.

## ◆ dissector_all_tables_foreach_changed()

WS_DLL_PUBLIC void dissector_all_tables_foreach_changed | ( | DATFunc | func,
|  | void * | user_data )

Iterate over dissectors with non-default "decode as" settings.

Walk all dissector tables calling a user supplied function only on any "decode as" entry that has been changed from its original state.

Parameters

  [in] | func | The function to call for each dissector.
  [in] | user_data | User data to pass to the function.

## ◆ dissector_all_tables_foreach_table()

WS_DLL_PUBLIC void dissector_all_tables_foreach_table | ( | DATFunc_table | func,
|  | void * | user_data,
|  | GCompareFunc | compare_key_func )

Iterate over all dissector tables.

Walk the set of dissector tables calling a user supplied function on each table.

Parameters

  [in] | func | The function to call for each table.
  [in] | user_data | User data to pass to the function.
  [in] | compare_key_func | Function used to sort the set of tables before calling the function. No sorting is done if NULL.

## ◆ dissector_change_payload()

WS_DLL_PUBLIC void dissector_change_payload | ( | const char * | abbrev,
|  | dissector_handle_t | handle )

Override the payload dissector for an FT_NONE dissector table.

Parameters

  abbrev | The internal name of the payload dissector table.
  handle | The new dissector handle to assign as the payload dissector.

## ◆ dissector_change_string()

WS_DLL_PUBLIC void dissector_change_string | ( | const char * | name,
|  | const char * | pattern,
|  | dissector_handle_t | handle )

Override the dissector for a string value in a dissector table.

Parameters

  name | The internal name of the dissector table.
  pattern | The string selector value to override.
  handle | The new dissector handle to use for `pattern`.

## ◆ dissector_change_uint()

WS_DLL_PUBLIC void dissector_change_uint | ( | const char * | abbrev,
|  | const uint32_t | pattern,
|  | dissector_handle_t | handle )

Override the dissector for a uint value in a dissector table.

Parameters

  abbrev | The internal name of the dissector table.
  pattern | The uint selector value to override.
  handle | The new dissector handle to use for `pattern`.

## ◆ dissector_delete_all()

WS_DLL_PUBLIC void dissector_delete_all | ( | const char * | name,
|  | dissector_handle_t | handle )

Remove all entries for a given dissector handle from a table.

Parameters

  name | The internal name of the dissector table.
  handle | The dissector handle whose entries should be removed.

## ◆ dissector_delete_guid()

WS_DLL_PUBLIC void dissector_delete_guid | ( | const char * | name,
|  | guid_key * | guid_val,
|  | dissector_handle_t | handle )

Delete a GUID from a dissector table.

Parameters

  name | The name of the dissector table.
  guid_val | The GUID value to delete.
  handle | The dissector handle to associate with the GUID.

## ◆ dissector_delete_string()

WS_DLL_PUBLIC void dissector_delete_string | ( | const char * | name,
|  | const char * | pattern,
|  | dissector_handle_t | handle )

Remove the entry for a specific string value from a dissector table.

Parameters

  name | The internal name of the dissector table.
  pattern | The string selector value to remove.
  handle | The dissector handle to remove.

## ◆ dissector_delete_uint()

WS_DLL_PUBLIC void dissector_delete_uint | ( | const char * | name,
|  | const uint32_t | pattern,
|  | dissector_handle_t | handle )

Remove the entry for a specific uint value from a dissector table.

Parameters

  name | The internal name of the dissector table.
  pattern | The uint selector value to remove.
  handle | The dissector handle to remove.

## ◆ dissector_delete_uint_range()

WS_DLL_PUBLIC void dissector_delete_uint_range | ( | const char * | abbrev,
|  | range_t * | range,
|  | dissector_handle_t | handle )

Remove a range of uint-keyed entries from a dissector table.

Parameters

  abbrev | The internal name of the dissector table.
  range | The range of uint selector values to remove.
  handle | The dissector handle to remove.

## ◆ dissector_dump_dissector_tables()

WS_DLL_PUBLIC void dissector_dump_dissector_tables | ( | void |  | ) |

Print information about all registered dissector tables to standard output.

Prints table metadata only; individual table entries are not shown.

## ◆ dissector_get_custom_table_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_get_custom_table_handle | ( | dissector_table_t | sub_dissectors,
|  | void * | key )

Look for a given key in a given "custom" dissector table and, if found, return the current dissector handle for that key.

Parameters

  [in] | sub_dissectors | Dissector table to search.
  [in] | key | Value to match, e.g. RPC key for its subdissectors

Returns
  The matching dissector handle on success, NULL if no match is found.

## ◆ dissector_get_default_string_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_get_default_string_handle | ( | const char * | name,
|  | const char * | string )

Look for a given value in a given string dissector table and, if found, return the default dissector handle for that value.

Parameters

  [in] | name | Dissector table name.
  [in] | string | Value to match, e.g. the OID for the BER dissector.

Returns
  The matching dissector handle on success, NULL if no match is found.

## ◆ dissector_get_default_uint_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_get_default_uint_handle | ( | const char * | name,
|  | const uint32_t | uint_val )

Look for a given value in a given uint dissector table and, if found, return the default dissector handle for that value.

Parameters

  [in] | name | Dissector table name.
  [in] | uint_val | Value to match, e.g. the port number for the TCP dissector.

Returns
  The matching dissector handle on success, NULL if no match is found.

## ◆ dissector_get_guid_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_get_guid_handle | ( | dissector_table_t const | sub_dissectors,
|  | guid_key * | guid_val )

Look for a given value in a given guid dissector table and, if found, return the current dissector handle for that value.

Parameters

  [in] | sub_dissectors | Dissector table to search.
  [in] | guid_val | Value to match, e.g. the GUID number for the GUID dissector.

Returns
  The matching dissector handle on success, NULL if no match is found.

Look for a given value in a given guid dissector table and, if found, return the current dissector handle for that value.

Parameters

  [in] | sub_dissectors | Dissector table to search.
  [in] | guid_val | Value to match.

Returns
  The matching dissector handle on success, NULL if no match is found.

## ◆ dissector_get_payload_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_get_payload_handle | ( | dissector_table_t const | dissector_table | ) |

Return the currently active dissector handle for a payload dissector table.

Returns the handle of whichever dissector was selected for the given FT_NONE table, typically via Decode As.

Parameters

  dissector_table | The payload (FT_NONE) dissector table to query.

Returns
  The currently active dissector handle, or NULL if none is set.

## ◆ dissector_get_string_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_get_string_handle | ( | dissector_table_t | sub_dissectors,
|  | const char * | string )

Look for a given value in a given string dissector table and, if found, return the current dissector handle for that value.

Parameters

  [in] | sub_dissectors | Dissector table to search.
  [in] | string | Value to match, e.g. the OID for the BER dissector.

Returns
  The matching dissector handle on success, NULL if no match is found.

## ◆ dissector_get_uint_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_get_uint_handle | ( | dissector_table_t const | sub_dissectors,
|  | const uint32_t | uint_val )

Look for a given value in a given uint dissector table and, if found, return the current dissector handle for that value.

Parameters

  [in] | sub_dissectors | Dissector table to search.
  [in] | uint_val | Value to match, e.g. the port number for the TCP dissector.

Returns
  The matching dissector handle on success, NULL if no match is found.

## ◆ dissector_handle_get_description()

WS_DLL_PUBLIC const char * dissector_handle_get_description | ( | const dissector_handle_t | handle | ) |

Return the user-visible description for a dissector handle.

Parameters

  handle | A valid dissector handle.

Returns
  The description string, or NULL if `handle` is invalid.

## ◆ dissector_handle_get_dissector_name()

WS_DLL_PUBLIC const char * dissector_handle_get_dissector_name | ( | const dissector_handle_t | handle | ) |

Return the registered name of a dissector from its handle.

Parameters

  handle | A valid dissector handle.

Returns
  The name string passed to register_dissector() or create_dissector_handle_with_name(), or NULL for anonymous handles.

## ◆ dissector_handle_get_pref_suffix()

WS_DLL_PUBLIC const char * dissector_handle_get_pref_suffix | ( | const dissector_handle_t | handle | ) |

Return the preferences suffix string for a dissector handle.

Parameters

  handle | A valid dissector handle.

Returns
  The preference key suffix string, or NULL if none is set.

## ◆ dissector_handle_get_protocol_index()

WS_DLL_PUBLIC int dissector_handle_get_protocol_index | ( | const dissector_handle_t | handle | ) |

Return the protocol index for a dissector handle.

Parameters

  handle | A valid dissector handle.

Returns
  The `proto` index (as returned by `proto_register_protocol()`) for the protocol associated with `handle`, or -1 if invalid.

## ◆ dissector_handle_get_protocol_long_name()

WS_DLL_PUBLIC const char * dissector_handle_get_protocol_long_name | ( | const dissector_handle_t | handle | ) |

Return the long (full) protocol name for a dissector handle.

Parameters

  handle | A valid dissector handle.

Returns
  The long protocol name string (e.g. `"Hypertext Transfer Protocol"`), or NULL if `handle` is invalid.

## ◆ dissector_handle_get_protocol_short_name()

WS_DLL_PUBLIC const char * dissector_handle_get_protocol_short_name | ( | const dissector_handle_t | handle | ) |

Return the short protocol name for a dissector handle.

Parameters

  handle | A valid dissector handle.

Returns
  The short protocol name string (e.g. `"HTTP"`), or NULL if `handle` is invalid.

## ◆ dissector_is_string_changed()

WS_DLL_PUBLIC bool dissector_is_string_changed | ( | dissector_table_t const | subdissectors,
|  | const char * | string )

Return whether a string dissector table entry has been overridden.

Returns true if the entry for `string` has been changed from its registered default (e.g. via Decode As), false otherwise.

Parameters

  subdissectors | The dissector table to query.
  string | The string selector value to check.

Returns
  true if the entry has been changed, false otherwise.

## ◆ dissector_is_uint_changed()

WS_DLL_PUBLIC bool dissector_is_uint_changed | ( | dissector_table_t const | sub_dissectors,
|  | const uint32_t | uint_val )

Return whether a uint dissector table entry has been overridden.

Returns true if the entry for `uint_val` has been changed from its registered default (e.g. via Decode As or a preference registered with dissector_add_uint_with_preference()), false otherwise.

Parameters

  sub_dissectors | The dissector table to query.
  uint_val | The uint selector value to check.

Returns
  true if the entry has been changed, false otherwise.

## ◆ dissector_reset_payload()

WS_DLL_PUBLIC void dissector_reset_payload | ( | const char * | name | ) |

Reset an FT_NONE payload dissector table to its initial registered value.

Parameters

  name | The internal name of the payload dissector table.

## ◆ dissector_reset_string()

WS_DLL_PUBLIC void dissector_reset_string | ( | const char * | name,
|  | const char * | pattern )

Reset a string dissector table entry to its initial registered value.

Parameters

  name | The internal name of the dissector table.
  pattern | The string selector value to reset.

## ◆ dissector_reset_uint()

WS_DLL_PUBLIC void dissector_reset_uint | ( | const char * | name,
|  | const uint32_t | pattern )

Reset a uint dissector table entry to its initial registered value.

Parameters

  name | The internal name of the dissector table.
  pattern | The uint selector value to reset.

## ◆ dissector_table_allow_decode_as()

WS_DLL_PUBLIC void dissector_table_allow_decode_as | ( | dissector_table_t | dissector_table | ) |

Mark a dissector table as supporting Decode As.

Note
  Prefer calling register_decode_as() instead of this function directly. This function is public only for legacy reasons.

Parameters

  dissector_table | The dissector table to mark.

## ◆ dissector_table_allow_decode_as_internal()

void dissector_table_allow_decode_as_internal | ( | dissector_table_t | dissector_table | ) |
| extern inline

Mark a dissector table as supporting Decode As.

Note
  Internal to libwireshark. Not for use by dissectors or applications.

Parameters

  dissector_table | The dissector table to mark.

## ◆ dissector_table_foreach()

WS_DLL_PUBLIC void dissector_table_foreach | ( | const char * | table_name,
|  | DATFunc | func,
|  | void * | user_data )

Iterate over dissectors in a table.

Walk one dissector table's hash table calling a user supplied function on each entry.

Parameters

  [in] | table_name | The name of the dissector table, e.g. "ip.proto".
  [in] | func | The function to call for each dissector.
  [in] | user_data | User data to pass to the function.

## ◆ dissector_table_foreach_changed()

void dissector_table_foreach_changed | ( | const char * | table_name,
|  | DATFunc | func,
|  | void * | user_data )

Iterate over dissectors in a table with non-default "decode as" settings.

Walk one dissector table calling a user supplied function only on any entry that has been changed from its original state.

Parameters

  [in] | table_name | The name of the dissector table, e.g. "ip.proto".
  [in] | func | The function to call for each dissector.
  [in] | user_data | User data to pass to the function.

## ◆ dissector_table_foreach_handle()

WS_DLL_PUBLIC void dissector_table_foreach_handle | ( | const char * | table_name,
|  | DATFunc_handle | func,
|  | void * | user_data )

Iterate over dissectors in a table by handle.

Walk one dissector table's list of handles calling a user supplied function on each entry.

Parameters

  [in] | table_name | The name of the dissector table, e.g. "ip.proto".
  [in] | func | The function to call for each dissector.
  [in] | user_data | User data to pass to the function.

## ◆ dissector_table_get_dissector_handle()

WS_DLL_PUBLIC dissector_handle_t dissector_table_get_dissector_handle | ( | dissector_table_t | dissector_table,
|  | const char * | description )

Look up a dissector handle in a table by its description string.

Parameters

  dissector_table | The dissector table to search.
  description | The human-readable description of the target dissector.

Returns
  The matching dissector handle, or NULL if not found.

## ◆ dissector_table_get_dissector_handles()

WS_DLL_PUBLIC GSList * dissector_table_get_dissector_handles | ( | dissector_table_t | dissector_table | ) |

Return the list of all dissector handles registered with a table.

Parameters

  dissector_table | The dissector table to query.

Returns
  A `GSList` of `dissector_handle_t` entries registered with the table.

## ◆ dissector_table_get_type()

WS_DLL_PUBLIC ftenum_t dissector_table_get_type | ( | dissector_table_t | dissector_table | ) |

Return the selector field type of a dissector table.

Parameters

  dissector_table | The dissector table to query.

Returns
  The `ftenum_t` field type used as the selector for this table.

## ◆ dissector_table_supports_decode_as()

WS_DLL_PUBLIC bool dissector_table_supports_decode_as | ( | dissector_table_t | dissector_table | ) |
| inline

Return whether a dissector table supports Decode As.

Parameters

  dissector_table | The dissector table to query.

Returns
  true if the table allows Decode As, false otherwise.

## ◆ dissector_try_guid_with_data()

WS_DLL_PUBLIC int dissector_try_guid_with_data | ( | dissector_table_t | sub_dissectors,
|  | guid_key * | guid_val,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | const bool | add_proto_name,
|  | void * | data )

Look for a given value in a given guid dissector table and, if found, call the dissector with the arguments supplied, and return true, otherwise return false.

Parameters

  sub_dissectors | The dissector table to search.
  guid_val | The GUID value to look for.
  tvb | The TVBuffer containing the data to dissect.
  pinfo | Packet information for the current packet.
  tree | The protocol tree to add nodes to.
  add_proto_name | Whether to add the protocol name to each node.
  data | Pointer to additional data to pass to the dissector.

Returns
  The number of bytes consumed by the dissector, or 0 if no matching entry was found.

## ◆ dissector_try_heuristic()

WS_DLL_PUBLIC bool dissector_try_heuristic | ( | heur_dissector_list_t | sub_dissectors,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | heur_dtbl_entry_t ** | hdtbl_entry,
|  | void * | data )

Try all the dissectors in a given heuristic dissector list. This is done, until we find one that recognizes the protocol. Call this while the parent dissector running.

Parameters

  sub_dissectors | the sub-dissector list
  tvb | the tvbuff with the (remaining) packet data
  pinfo | the packet info of this packet (additional info)
  tree | the protocol tree to be build or NULL
  hdtbl_entry | returns the last tried dissectors hdtbl_entry.
  data | parameter to pass to subdissector

Returns
  true if the packet was recognized by the sub-dissector (stop dissection here)

## ◆ dissector_try_payload_with_data()

WS_DLL_PUBLIC int dissector_try_payload_with_data | ( | dissector_table_t | sub_dissectors,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | const bool | add_proto_name,
|  | void * | data )

Invoke the currently assigned payload dissector for a dissector table.

Uses whichever dissector has been assigned as the payload dissector for `sub_dissectors` (e.g. via Decode As or a default assignment) and, if one is assigned, calls it with the supplied arguments. Unlike dissector_try_uint_with_data(), this does not look up by a key value — it directly invokes the table's designated payload dissector.

Parameters

  sub_dissectors | The dissector table whose payload dissector to invoke.
  tvb | The packet buffer to dissect.
  pinfo | The packet info for the current packet.
  tree | The protocol tree to populate.
  add_proto_name | Whether to add the protocol name to the protocol tree.
  data | Caller-supplied data passed through to the dissector.

Returns
  The number of bytes consumed by the dissector, or 0 if no payload dissector is assigned.

## ◆ dissector_try_string_with_data()

WS_DLL_PUBLIC int dissector_try_string_with_data | ( | dissector_table_t | sub_dissectors,
|  | const char * | string,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | const bool | add_proto_name,
|  | void * | data )

Look for a given string in a given dissector table and, if found, call the dissector with the arguments supplied, and return the number of bytes consumed, otherwise return 0.

Parameters

  sub_dissectors | The dissector table to search.
  string | The string to look for.
  tvb | The TVBuffer containing the data to dissect.
  pinfo | Packet information for the current packet.
  tree | The protocol tree to add nodes to.
  add_proto_name | Whether to add the protocol name to each node.
  data | Pointer to additional data to pass to the dissector.

Returns
  The number of bytes consumed by the dissector, or 0 if not found.

## ◆ dissector_try_uint()

WS_DLL_PUBLIC int dissector_try_uint | ( | dissector_table_t | sub_dissectors,
|  | const uint32_t | uint_val,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree )

Try to dissect using a uint-keyed dissector table entry.

Looks up `uint_val` in `sub_dissectors` and, if found, calls the matching dissector with the supplied arguments.

Parameters

  sub_dissectors | The dissector table to search.
  uint_val | The uint selector value to look up.
  tvb | The packet buffer.
  pinfo | The packet info.
  tree | The protocol tree.

Returns
  The number of bytes consumed by the dissector, or 0 if no matching entry was found.

## ◆ dissector_try_uint_with_data()

WS_DLL_PUBLIC int dissector_try_uint_with_data | ( | dissector_table_t | sub_dissectors,
|  | const uint32_t | uint_val,
|  | tvbuff_t * | tvb,
|  | packet_info * | pinfo,
|  | proto_tree * | tree,
|  | const bool | add_proto_name,
|  | void * | data )

Try to dissect using a uint-keyed dissector table entry, with additional options and caller data.

Looks up `uint_val` in `sub_dissectors` and, if found, calls the matching dissector with the supplied arguments.

Parameters

  sub_dissectors | The dissector table to search.
  uint_val | The uint selector value to look up.
  tvb | The packet buffer.
  pinfo | The packet info.
  tree | The protocol tree.
  add_proto_name | Whether to add the protocol name to the tree.
  data | Caller-supplied data passed to the dissector.

Returns
  The number of bytes consumed by the dissector, or 0 if no matching entry was found.

## ◆ dtbl_entry_get_handle()

WS_DLL_PUBLIC dissector_handle_t dtbl_entry_get_handle | ( | dtbl_entry_t * | dtbl_entry | ) |

Return the currently active dissector handle for a dissector table entry.

Parameters

  dtbl_entry | The dissector table entry to query.

Returns
  The currently active dissector handle for the entry.

## ◆ dtbl_entry_get_initial_handle()

WS_DLL_PUBLIC dissector_handle_t dtbl_entry_get_initial_handle | ( | dtbl_entry_t * | entry | ) |

Return the initial (registered) dissector handle for a dissector table entry.

Parameters

  entry | The dissector table entry to query.

Returns
  The original registered dissector handle for the entry, or NULL if no initial handle was recorded.

## ◆ find_depend_dissector_list()

WS_DLL_PUBLIC depend_dissector_list_t find_depend_dissector_list | ( | const char * | name | ) |

Find the list of protocol dependencies

Parameters

  name | Protocol short name to search for

Returns
  return list of dependent was successfully registered

## ◆ find_dissector()

WS_DLL_PUBLIC dissector_handle_t find_dissector | ( | const char * | name | ) |

Find a registered dissector by name.

Parameters

  name | The short name used at register_dissector() time.

Returns
  The `dissector_handle_t` for `name`, or NULL if no dissector with that name is registered.

## ◆ find_dissector_add_dependency()

WS_DLL_PUBLIC dissector_handle_t find_dissector_add_dependency | ( | const char * | name,
|  | const int | parent_proto )

Find a registered dissector by name and record a protocol dependency.

Parameters

  name | The short name of the dissector to find.
  parent_proto | The protocol index of the calling dissector's protocol.

Returns
  The `dissector_handle_t` for `name`, or NULL if not found.

Find a dissector by name and add parent protocol as a dependency

## ◆ find_dissector_table()

WS_DLL_PUBLIC dissector_table_t find_dissector_table | ( | const char * | name | ) |

Find a dissector table by its internal name.

Parameters

  name | The internal name of the dissector table.

Returns
  The dissector table handle, or NULL if not found.

## ◆ find_heur_dissector_by_unique_short_name()

WS_DLL_PUBLIC heur_dtbl_entry_t * find_heur_dissector_by_unique_short_name | ( | const char * | short_name | ) |

Find a heuristic dissector by the unique short protocol name provided during registration.

Parameters

  short_name | short name of the protocol to look at

Returns
  pointer to the heuristic dissector entry, NULL if not such dissector exists

## ◆ find_heur_dissector_list()

WS_DLL_PUBLIC heur_dissector_list_t find_heur_dissector_list | ( | const char * | name | ) |

Find a heuristic dissector table by table name.

Parameters

  name | name of the dissector table

Returns
  pointer to the table on success, NULL if no such table exists

## ◆ free_data_sources()

void free_data_sources | ( | packet_info * | pinfo | ) |
| extern

Free up a frame's list of data sources.

Parameters

  pinfo | The packet info structure whose data sources should be freed.

## ◆ get_data_source_by_name()

WS_DLL_PUBLIC struct data_source * get_data_source_by_name | ( | const packet_info * | pinfo,
|  | const char * | name )

Find and return data source with the given name.

Parameters

  pinfo | packet_info for the packet whose data sources are to be searched
  name | name of the data source

Returns
  the data source or NULL if not found

## ◆ get_data_source_by_tvb()

WS_DLL_PUBLIC struct data_source * get_data_source_by_tvb | ( | const packet_info * | pinfo,
|  | const tvbuff_t * | tvb )

Find and return data source with the given tvb.

Parameters

  pinfo | packet_info for the packet whose data sources are to be searched
  tvb | tvb of the data source

Returns
  the data source or NULL if not found

## ◆ get_data_source_description()

WS_DLL_PUBLIC char * get_data_source_description | ( | const struct data_source * | src | ) |

Return the description of a data source.

Parameters

  src | The data source whose description should be returned.

Returns
  A newly allocated string of the form "Name (N bytes)". This string should be freed with "g_free".

## ◆ get_data_source_index_by_tvb()

WS_DLL_PUBLIC int32_t get_data_source_index_by_tvb | ( | const packet_info * | pinfo,
|  | const tvbuff_t * | tvb )

Find and return the index of a data source for the given tvb.

Parameters

  pinfo | packet_info for the packet whose data sources are to be searched
  tvb | tvb of the data source. This should be the output of tvb_get_ds_tvb() for an arbitrary starting TVB.

Returns
  the index of the data source or -1 if not found

## ◆ get_data_source_media_type()

WS_DLL_PUBLIC data_source_media_type_e get_data_source_media_type | ( | const struct data_source * | src | ) |

Get a data source's media type.

Parameters

  src | The data source.

Returns
  A media type.

## ◆ get_data_source_name()

WS_DLL_PUBLIC const char * get_data_source_name | ( | const struct data_source * | src | ) |

Return the display name of a data source.

Parameters

  src | The data source whose name should be returned.

Returns
  The name string associated with `src`. The string is valid for the lifetime of the packet dissection pool; do not free it.

## ◆ get_data_source_tvb()

WS_DLL_PUBLIC tvbuff_t * get_data_source_tvb | ( | const struct data_source * | src | ) |

Return the tvbuff associated with a data source.

Parameters

  src | The data source whose tvb should be returned.

Returns
  The `tvbuff_t` associated with `src`. The pointer is valid for the lifetime of the packet dissection; do not free it directly.

## ◆ get_dissector_names()

WS_DLL_PUBLIC GList * get_dissector_names | ( | void |  | ) |

Return a GList of all registered dissector name strings.

Returns
  A newly allocated `GList` of registered dissector name strings.

## ◆ get_dissector_table_param()

WS_DLL_PUBLIC int get_dissector_table_param | ( | const char * | name | ) |

Return the parameter value associated with a dissector table.

Parameters

  name | The internal name of the dissector table.

Returns
  The integer parameter for the table.

## ◆ get_dissector_table_selector_type()

WS_DLL_PUBLIC ftenum_t get_dissector_table_selector_type | ( | const char * | name | ) |

Return the field type of the selector for a dissector table.

Parameters

  name | The internal name of the dissector table.

Returns
  The `ftenum_t` selector field type for the table.

## ◆ get_dissector_table_ui_name()

WS_DLL_PUBLIC const char * get_dissector_table_ui_name | ( | const char * | name | ) |

Return the UI display name for a dissector table.

Parameters

  name | The internal name of the dissector table.

Returns
  The UI name string for the table.

## ◆ has_heur_dissector_list()

WS_DLL_PUBLIC bool has_heur_dissector_list | ( | const char * | name | ) |

Check if a heuristic dissector list of the given name exists.

Parameters

  name | The name of the heuristic dissector list to check for.

Returns
  true if a heur_dissector list of that name exists to be registered into, false otherwise.

## ◆ have_postdissector()

bool have_postdissector | ( | void |  | ) |
| extern

Return whether any postdissectors are registered.

Checks if at least one postdissector has been registered with the dissection engine.

Note
  Internal to libwireshark. Not for use by dissectors or applications.

Returns
  true if at least one postdissector is registered, false otherwise.

## ◆ heur_dissector_add()

WS_DLL_PUBLIC void heur_dissector_add | ( | const char * | name,
|  | heur_dissector_t | dissector,
|  | const char * | display_name,
|  | const char * | internal_name,
|  | const int | proto,
|  | heuristic_enable_e | enable )

Add a sub-dissector to a heuristic dissector list. Call this in the proto_handoff function of the sub-dissector.

Parameters

  name | the name of the heuristic dissector table into which to register the dissector, e.g. "tcp"
  dissector | the sub-dissector to be registered
  display_name | the string used to present heuristic to user, e.g. "HTTP over TCP"
  internal_name | the string used for "internal" use to identify heuristic, e.g. "http_tcp"
  proto | the protocol id of the sub-dissector
  enable | initially enabled or not

## ◆ heur_dissector_delete()

WS_DLL_PUBLIC void heur_dissector_delete | ( | const char * | name,
|  | heur_dissector_t | dissector,
|  | const int | proto )

Remove a sub-dissector from a heuristic dissector list. Call this in the prefs_reinit function of the sub-dissector.

Parameters

  name | the name of the "parent" protocol, e.g. "tcp"
  dissector | the sub-dissector to be unregistered
  proto | the protocol id of the sub-dissector

## ◆ heur_dissector_list_get_description()

WS_DLL_PUBLIC const char * heur_dissector_list_get_description | ( | heur_dissector_list_t | list | ) |

Get description of heuristic sub-dissector list.

Parameters

  list | the dissector list

## ◆ heur_dissector_table_foreach()

WS_DLL_PUBLIC void heur_dissector_table_foreach | ( | const char * | table_name,
|  | DATFunc_heur | func,
|  | void * | user_data )

Iterate over heuristic dissectors in a table.

Walk one heuristic dissector table's list calling a user supplied function on each entry.

Parameters

  [in] | table_name | The name of the dissector table, e.g. "tcp".
  [in] | func | The function to call for each dissector.
  [in] | user_data | User data to pass to the function.

## ◆ increment_dissection_depth()

WS_DLL_PUBLIC void increment_dissection_depth | ( | packet_info * | pinfo | ) |

Increment the dissection depth. This should be used to limit recursion outside the tree depth checks in call_dissector and dissector_try_heuristic.

Parameters

  pinfo | Packet Info.

## ◆ increment_dissection_depth_by_n()

WS_DLL_PUBLIC void increment_dissection_depth_by_n | ( | packet_info * | pinfo,
|  | unsigned | n )

Increment the dissection depth by a value. This should be used to limit recursion outside the tree depth checks in call_dissector and dissector_try_heuristic.

Parameters

  pinfo | Packet Info.
  n | The value by which to increment the depth

## ◆ init_dissection()

void init_dissection | ( | const char * | app_env_var_prefix | ) |

Initialize all data structures used for dissection.

Parameters

  app_env_var_prefix | The prefix for environment variables that control dissection.

## ◆ mark_frame_as_depended_upon()

WS_DLL_PUBLIC void mark_frame_as_depended_upon | ( | frame_data * | fd,
|  | uint32_t | frame_num )

Mark another frame as depended upon by the current frame.

This information is used to ensure that when the current frame is exported or saved that the depended upon frames necessary for correct dissection are also exported (along with the frames that those depend upon, in infinite descent.) The fragment handling functions in reassemble.c mark any frame used to reassemble the current frame as depended upon; dissectors can also mark frames themselves.

In Wireshark, the "Include depended upon packets" checkbox in the Export Specified Packets dialog (enabled by default) controls whether depended upon frames of selected frames are also exported. TShark also saves any depended upon frames when saving filtered packets to a file.

Parameters

  fd | The frame data for the current frame.
  frame_num | The frame number of the frame to mark as depended upon.

## ◆ postdissectors_want_hfids()

WS_DLL_PUBLIC bool postdissectors_want_hfids | ( | void |  | ) |

Return whether any postdissector has requested specific hfids.

Returns true if at least one registered postdissector has declared interest in one or more header field IDs (hfids), meaning the dissection engine must prime those fields before calling postdissectors.

Returns
  true if any postdissector wants at least one hfid, false otherwise.

## ◆ prime_epan_dissect_with_postdissector_wanted_hfids()

void prime_epan_dissect_with_postdissector_wanted_hfids | ( | epan_dissect_t * | edt | ) |
| extern

Prime an epan_dissect_t with all hfids requested by postdissectors.

Registers all header field IDs declared by postdissectors into `edt` so that those fields are extracted and available during the first-pass dissection of an unvisited frame. libwireshark calls this automatically before dissecting any frame that has not yet been visited; it should not be called manually by dissectors or applications.

Note
  Internal to libwireshark. Not for use by dissectors or applications.

Parameters

  edt | The epan_dissect_t to prime with postdissector-requested hfids.

## ◆ register_cleanup_routine()

WS_DLL_PUBLIC void register_cleanup_routine | ( | void(* | func )(void) | ) |

Allows protocols to register "cleanup" routines, which are called after closing a capture file (or when preferences are changed, in that case these routines are called before the init routines are executed). It can be used to release resources that are allocated in an "init" routine.

## ◆ register_custom_dissector_table()

WS_DLL_PUBLIC dissector_table_t register_custom_dissector_table | ( | const char * | name,
|  | const char * | ui_name,
|  | const int | proto,
|  | GHashFunc | hash_func,
|  | GEqualFunc | key_equal_func,
|  | GDestroyNotify | key_destroy_func )

Similar to register_dissector_table, but with a "custom" hash function to store subdissectors.

Parameters

  name | the name of the dissector table, e.g. "ip.proto"
  ui_name | the name of the dissector table to show in the UI, e.g. "IP Protocols"
  proto | the protocol ID of the protocol that registers this table, or -1 if the table is not associated with a protocol
  hash_func | the hash function for the custom hash table
  key_equal_func | the function to compare keys in the hash table

Returns
  the dissector table created for this name

## ◆ register_depend_dissector()

WS_DLL_PUBLIC bool register_depend_dissector | ( | const char * | parent,
|  | const char * | dependent )

Register a protocol dependency This is done automatically when registering with a dissector or heuristic table. This is for "manual" registration when a dissector ends up calling another through call_dissector (or similar) so dependencies can be determined

Parameters

  parent | "Parent" protocol short name
  dependent | "Dependent" protocol short name

Returns
  return true if dependency was successfully registered

## ◆ register_dissector()

WS_DLL_PUBLIC dissector_handle_t register_dissector | ( | const char * | name,
|  | dissector_t | dissector,
|  | const int | proto )

Register a new dissector with the global dissector registry.

Parameters

  name | Short, unique machine-friendly name for this dissector (e.g. `"http"`).
  dissector | The dissector function to call.
  proto | Protocol index returned by `proto_register_protocol()`.

Returns
  The newly created and registered `dissector_handle_t`.

## ◆ register_dissector_table()

WS_DLL_PUBLIC dissector_table_t register_dissector_table | ( | const char * | name,
|  | const char * | ui_name,
|  | const int | proto,
|  | const ftenum_t | type,
|  | const int | param )

a protocol uses the function to register a sub-dissector table

'param' is the display base for integer tables, STRING_CASE_SENSITIVE or STRING_CASE_INSENSITIVE for string tables, and ignored for other table types.

Parameters

  name | the name of the dissector table, e.g. "ip.proto"
  ui_name | the name of the dissector table to show in the UI, e.g. "IP Protocols"
  proto | the protocol ID of the protocol that registers this table, or -1 if the table is not associated with a protocol
  type | the type of the selector for this dissector table, e.g. FT_UINT8 for "ip.proto"
  param | the parameter for this dissector table, e.g. BASE_HEX for "ip.proto"

Returns
  the dissector table created for this name

## ◆ register_dissector_table_alias()

WS_DLL_PUBLIC void register_dissector_table_alias | ( | dissector_table_t | dissector_table,
|  | const char * | alias_name )

Register a dissector table alias. This is for dissectors whose original name has changed, e.g. SSL to TLS.

Parameters

  dissector_table | dissector table returned by register_dissector_table.
  alias_name | alias for the dissector table name.

## ◆ register_dissector_with_data()

WS_DLL_PUBLIC dissector_handle_t register_dissector_with_data | ( | const char * | name,
|  | dissector_cb_t | dissector,
|  | const int | proto,
|  | void * | cb_data )

Register a new dissector that carries an opaque callback pointer.

Parameters

  name | Short, unique machine-friendly name for this dissector.
  dissector | The callback-style dissector function to call.
  proto | Protocol index returned by `proto_register_protocol()`.
  cb_data | Opaque pointer passed through to `dissector` on each invocation.

Returns
  The newly created and registered `dissector_handle_t`.

## ◆ register_dissector_with_description()

WS_DLL_PUBLIC dissector_handle_t register_dissector_with_description | ( | const char * | name,
|  | const char * | description,
|  | dissector_t | dissector,
|  | const int | proto )

Register a new dissector with a custom user-visible description.

Parameters

  name | Short, unique machine-friendly name for this dissector.
  description | Human-readable description shown in the UI.
  dissector | The dissector function to call.
  proto | Protocol index returned by `proto_register_protocol()`.

Returns
  The newly created and registered `dissector_handle_t`.

## ◆ register_final_registration_routine()

WS_DLL_PUBLIC void register_final_registration_routine | ( | void(* | func )(void) | ) |

Allow dissectors to register a "final_registration" routine that is run like the proto_register_XXX() routine, but the end end of the epan_init() function; that is, after all other subsystems (such as dfilters) have finished initializing. This is useful for dissector registration routines which need to compile display filters. dfilters can't initialize itself until all protocols have registered themselves.

## ◆ register_heur_dissector_list()

WS_DLL_PUBLIC heur_dissector_list_t register_heur_dissector_list | ( | const char * | name,
|  | const int | proto )

A protocol uses this function to register a heuristic sub-dissector list. Call this in the parent dissectors proto_register function.

Parameters

  name | the name of this protocol
  proto | the value obtained when registering the protocol

## ◆ register_heur_dissector_list_with_description()

WS_DLL_PUBLIC heur_dissector_list_t register_heur_dissector_list_with_description | ( | const char * | name,
|  | const char * | ui_name,
|  | const int | proto )

A protocol uses this function to register a heuristic sub-dissector list. Call this in the parent dissectors proto_register function.

Parameters

  name | a unique short name for the list
  ui_name | the name used in the user interface
  proto | the value obtained when registering the protocol

## ◆ register_init_routine()

WS_DLL_PUBLIC void register_init_routine | ( | void(* | func )(void) | ) |

Allow protocols to register "init" routines, which are called before we make a pass through a capture file and dissect all its packets (e.g., when we read in a new capture file, or run a "filter packets" or "colorize packets" pass over the current capture file or when the preferences are changed).

## ◆ register_postdissector()

WS_DLL_PUBLIC void register_postdissector | ( | dissector_handle_t | handle | ) |

Register a postdissector; the argument is the dissector handle for it.

Parameters

  handle | The dissector handle for the postdissector to register.

## ◆ register_shutdown_routine()

WS_DLL_PUBLIC void register_shutdown_routine | ( | void(* | func )(void) | ) |

Allows protocols to register "shutdown" routines, which are called once, just before program exit

## ◆ remove_last_data_source()

WS_DLL_PUBLIC void remove_last_data_source | ( | packet_info * | pinfo | ) |

Remove the most recently added data source from a packet.

Removes the last-added data source, if it turns out it wasn't needed.

Parameters

  pinfo | The packet info structure whose last data source should be removed.

## ◆ set_actual_length()

WS_DLL_PUBLIC void set_actual_length | ( | tvbuff_t * | tvb,
|  | const unsigned | specified_len )

Given a tvbuff, and a length from a packet header, adjust the length of the tvbuff to reflect the specified length.

Parameters

  tvb | The tvbuff to adjust.
  specified_len | The length to set for the tvbuff.

## ◆ set_data_source_media_type()

WS_DLL_PUBLIC void set_data_source_media_type | ( | struct data_source * | src,
|  | data_source_media_type_e | media_type )

Set the media type for the data source. This will be used as a hint to display the source's tvbuff.

Parameters

  src | The data source.
  media_type | A valid media type.

## ◆ set_data_source_name()

WS_DLL_PUBLIC void set_data_source_name | ( | packet_info * | pinfo,
|  | struct data_source * | src,
|  | const char * | name )

Set the name for the data source.

Parameters

  pinfo | pinfo from whose pool to allocate a copy of the data source
  src | The data source.
  name | new name for the data source

## ◆ set_postdissector_wanted_hfids()

WS_DLL_PUBLIC void set_postdissector_wanted_hfids | ( | dissector_handle_t | handle,
|  | GArray * | wanted_hfids )

Specify a set of hfids that the postdissector will need on the first pass. This ensures that the fields will not be faked, and can be retrieved with proto_get_finfo_ptr_array.

Note
  There is no way to guarantee that fields added by other postdissectors will be available. (Issue #19804) This is for postdissectors that examine fields added by other dissectors on the first linear pass, and then store their own results in persistent memory for retrieval and adding in later passes. Postdissectors that need field values on later passes should call something else, like epan_set_always_visible() (which slows dissection.)

Parameters

  handle | The dissector handle used to register the postdissector.
  wanted_hfids | An array of hfids (type int), which should be NULL to clear the list. This function will take ownership of the array.