When you write a dissector for Wireshark, how do you test it? Looking for the visual output in the UI is not sufficient for a none-trivial protocol.

Is there a good way for unit testing of the dissector?

EDIT:

The structure of protocol frames is dynamic. The dissector must somehow interpret the content.

For example if the fifth field is one a byte array follows as sixth field. If it's two you have a double array and if it's three you have to add a zero terminated string.

This usually never happens in a daily work capture. That's why you need a synthetic capture data even with "impossible" content.

Edit
Report