When your dissector is called Called by the protocol below you Eg, packet-tcp.c, etc Once, on first pass, for every packet that is yours Mainly, summary info wanted this time around If filter specified, full decode needed If color filter in effect, full decode needed Everytime user clicks on one of your packets in the summary pane If a rescan is needed Once, again, for every packet that is yours