Wireshark · Ethereal-dev: [ethereal-dev] Modifying the packet buffer in dissectors

[Marcus Haebler <mhaebler@xxxxxxxxx>]

Since I am working on an IPSec/ESP dissector with decryption abilities 
I ran into the following problem (yes, you have to give Ethereal the SA 
information INCLUDING keys):

Is there a clean way to change the contents of the packet buffer
(if you decrypt it, you obviously have to change the buffer from 
cipher- to cleartext). This is especially important since you
are changing the dissectors to use tvbufs in the near future. As
of now I cannot see a mechanism in the tvbufs that would allow
this except for creating a new real data tvbuf which will generate 
even more overhead in the costly decryption dissector.

IPSec/ESP is not the only protocol with that problem. IP compression
essentially has the same problem if you want to see inside (which
is not implemented in Ethereal right now).

Since I am bound under the company NDA I cannot commit the diffs to the
source tree. :( But I hope to change that. Kind of off topic but could
some of you mail me your experiences with the management of their
company on releasing modifications made to open source projects at work?

Marcus Haebler