Finished this a while ago, and it’s close to reaching wireshark trunk. The patch is available here. The TN5250 specs and whatnot are available here . I’ve also created a TN5250 reference page on the Wireshark Wiki . As a protocol, TN5250 is only marginally less bizarre than it’s daddy TN3270. Oddly, it was also harder to code for – maybe state machines were all the rage at the time but they make a dissector’s life much more fussy. In summary, yet another typing-trial by endurance. Still haven’t figured out my motivation for doing it!