11.21. User DLTs dissector table

When a pcap file uses one of the user DLTs (147 to 162) Wireshark uses this table to know which dissector(s) to use for each user DLT.

This table is a user table, as described in Section 11.7, “User Table”, with the following fields:

DLT
One of the user dlts.
Payload dissector
This is the name of the payload dissector (the lowest layer in the packet data). (e.g., “eth_withfcs, "eth_withoutfcs”, and "eth_maybefcs" respectively for Ethernet frames that do, do not, or might possibly include the FCS at the end, “ip” for trying IPv4 then IPv6)
Header size
If there is a header (before the payload) this tells which size this header is. A value of 0 disables the header dissector.
Header dissector
The name of the header dissector to be used (uses “data” as default).
Trailer size
If there is a trailer (after the payload) this tells which size this trailer is. A value of 0 disables the trailer dissector.
Trailer dissector
The name of the trailer dissector to be used (uses “data” as default).