Wireshark · Ethereal-dev: [Ethereal-dev] RE: Obtaining previous dissector information

[Mark Pilant <Mark.Pilant@xxxxxxx>]

> OK.  I was curious, because I'd ideally like to try to close off any 
> direct access to the packet data, if possible, to make sure dissectors

> can't use it (because they're likely to get the wrong answer if they
do, 
> e.g. if any reassembly is being done).

I'd have to agree this is probably a good thing to do.

The only possible problem might be when it is desirable to obtain
information from a previously dissected payload.  Although I suppose one
could argue it would be better to pass knowledge of the information
within
one payload down to the lower level dissectors rather than trying to
reach
back and get it.  I think the private_data member of the packet_info
structure would be a way to do this (pass down information) but none of
the documentation I've seen is very clear on this point.

- Mark