1 files changed, 45 insertions, 0 deletions
diff --git a/include/wireframe/l7/dissector.hpp b/include/wireframe/l7/dissector.hpp
new file mode 100644
index 0000000..9b2cc32
--- /dev/null
+++ b/include/wireframe/l7/dissector.hpp
@@ -0,0 +1,45 @@
+#pragma once
+
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+// Small interface/vtable for L7 dissectors (PLAN.md's architecture
+// sketch), so protocols can be registered and added incrementally
+// without touching the L2-L4 decode path or main.cpp's dispatch logic.
+namespace wireframe::net {
+
+class L7Dissector {
+public:
+    virtual ~L7Dissector() = default;
+
+    // The transport port this dissector claims (e.g. 53 for DNS). A
+    // single fixed port is enough for the protocols in scope so far;
+    // dissectors needing a port range or heuristic sniffing can widen
+    // this later without changing the registry's shape.
+    virtual std::uint16_t port() const = 0;
+
+    // A one-line summary of the payload, or nullopt if it doesn't look
+    // like this protocol (e.g. truncated/malformed).
+    virtual std::optional<std::string> summarize(std::span<const unsigned char> payload) const = 0;
+};
+
+class L7Registry {
+public:
+    void add(const L7Dissector* dissector) { dissectors_.push_back(dissector); }
+
+    std::optional<std::string> dissect(std::uint16_t port,
+                                        std::span<const unsigned char> payload) const {
+        for (const auto* dissector : dissectors_) {
+            if (dissector->port() == port) return dissector->summarize(payload);
+        }
+        return std::nullopt;
+    }
+
+private:
+    std::vector<const L7Dissector*> dissectors_;
+};
+
+}  // namespace wireframe::net