11.4. Control Protocol Dissection

The user can control how protocols are dissected.

Each protocol has its own dissector, so dissecting a complete packet will typically involve several dissectors. As Wireshark tries to find the right dissector for each packet (using static “routes” and heuristics “guessing”), it might choose the wrong dissector in your specific case. For example, Wireshark won’t know if you use a common protocol on an uncommon TCP port, e.g., using HTTP on TCP port 800 instead of the standard port 80.

There are two ways to control the relations between protocol dissectors: disable a protocol dissector completely or temporarily divert the way Wireshark calls the dissectors.

11.4.1. The “Enabled Protocols” dialog box

The Enabled Protocols dialog box lets you enable or disable specific protocols. Most protocols are enabled by default. When a protocol is disabled, Wireshark stops processing a packet whenever that protocol is encountered.

[Note]Note

Disabling a protocol will prevent information about higher-layer protocols from being displayed. For example, suppose you disabled the IP protocol and selected a packet containing Ethernet, IP, TCP, and HTTP information. The Ethernet information would be displayed, but the IP, TCP and HTTP information would not - disabling IP would prevent it and the higher-layer protocols from being displayed.

To enable or disable protocols select AnalyzeEnabled Protocols…​. Wireshark will pop up the “Enabled Protocols” dialog box as shown in Figure 11.4, “The “Enabled Protocols” dialog box”.

Figure 11.4. The “Enabled Protocols” dialog box

ws enabled protocols

To disable or enable a protocol, simply click the checkbox using the mouse. Note that typing a few letters of the protocol name in the search box will limit the list to those protocols that contain these letters.

You can choose from the following actions:

Enable All
Enable all protocols in the list.
Disable All
Disable all protocols in the list.
Invert
Toggle the state of all protocols in the list.
OK
Save and apply the changes and close the dialog box, see Appendix B, Files and Folders for details.
Cancel
Cancel the changes and close the dialog box.

11.4.2. User Specified Decodes

The “Decode As” functionality lets you temporarily divert specific protocol dissections. This might be useful for example, if you do some uncommon experiments on your network.

Decode As is accessed by selecting the AnalyzeDecode As…​. Wireshark will pop up the “Decode As” dialog box as shown in Figure 11.5, “The “Decode As” dialog box”.

Figure 11.5. The “Decode As” dialog box

ws decode as

In this dialog you are able to edit entries by means of the edit buttons on the left.

You can also pop up this dialog box from the context menu in the packet list or packet details. It will then contain a new line based on the currently selected packet.

These settings will be lost if you quit Wireshark or change profile unless you save the entries.

+
Add new entry for selected packet
-
Remove the selected entry.
Copy
Copy the selected entry.
Clear
Clear the list of user specified decodes.
OK
Apply the user specified decodes and close the dialog box.
Save
Save and apply the user specified decodes and close the dialog box.
Cancel
Cancel the changes and close the dialog box.