Table of Contents
Each dissector decodes it's part of the protocol, and then hand off decoding to subsequent dissectors for an encapsulated protocol.
So it might all start with a Frame dissector which dissects the packet details of the capture file itself (e.g. timestamps), passes the data on to an Ethernet frame dissector that decodes the Ethernet header, and then passes the payload to the next dissector (e.g. IP) and so on. At each stage, details of the packet will be decoded and displayed.
Dissection can be implemented in two possible ways. One is to have a dissector module compiled into the main program, which means its always available. Another way is to make a plugin (a shared library/DLL) that registers itself to handle dissection. - XXX add a special explanation section for this?