1 files changed, 11 insertions, 1 deletions
diff --git a/include/wireframe/summarize.hpp b/include/wireframe/summarize.hpp
index e7e9ae3..840ddf9 100644
--- a/include/wireframe/summarize.hpp
+++ b/include/wireframe/summarize.hpp
@@ -11,6 +11,8 @@
 #include "wireframe/l7/dissector.hpp"
 #include "wireframe/l7/dns.hpp"
 #include "wireframe/l7/http.hpp"
+#include "wireframe/l7/mdns.hpp"
+#include "wireframe/l7/ssh.hpp"
 #include "wireframe/l7/tls.hpp"
 #include "wireframe/net/ethernet.hpp"
 #include "wireframe/net/icmp.hpp"
@@ -57,16 +59,24 @@ inline std::string tcp_flags_to_string(std::uint8_t flags) {
 // DNS alone never did, since it only ever runs over UDP port 53. TLS
 // (also TCP, port 443) covers what HTTP increasingly can't: most web
 // traffic today is encrypted, and SNI is the one piece of a TLS
-// handshake still readable without decrypting anything.
+// handshake still readable without decrypting anything. mDNS reuses
+// DNS's own parser (same wire format, different port/label) at
+// essentially no extra cost. SSH is the first dissector whose *entire*
+// protocol is one cleartext line before everything else encrypts --
+// unlike TLS's SNI, there's nothing further to ever add here.
 inline const net::L7Registry& l7_registry() {
     static const net::DnsDissector dns_dissector;
     static const net::HttpDissector http_dissector;
     static const net::TlsSniDissector tls_dissector;
+    static const net::MdnsDissector mdns_dissector;
+    static const net::SshDissector ssh_dissector;
     static const net::L7Registry registry = [] {
         net::L7Registry r;
         r.add(&dns_dissector);
         r.add(&http_dissector);
         r.add(&tls_dissector);
+        r.add(&mdns_dissector);
+        r.add(&ssh_dissector);
         return r;
     }();
     return registry;