Re: [Ethereal-users] Ethereal's Architecture

[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Jan 14, 2002 at 08:18:41PM +0800, darren wrote:
> 1) 	How does it decide which protocol-layer to start decoding? 

As the reply to your other message said, it determines it from
information supplied in the capture file header; if Ethereal is doing
the capture, the information it puts in the capture file header comes
from libpcap.

> 2)	How does it decide which Packet Dissector to use?

Ethereal typically doesn't use a single packet dissector; it starts out
calling one dissector, and that one then calls other dissectors, and so
on.

There are several mechanisms in Ethereal for choosing which dissector to
call; different dissectors use different mechanisms.

> 3)	How to add new dissectors?

See the various "README.*" files in the "doc" directory of the Ethereal
source tree.