Ethereal-dev: Re: [Ethereal-dev] How can I get offset of some field from tcp data zone?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 04 Jan 2006 02:00:05 -0800
scz wrote:

In some sub dissector, for example:

TCP
    NBT
        SMB
            DCE/RPC
                stub data

I'm unmarshaling the stub data, and want to show offset to &NBT in graphic
tree. Can I get/compute the offset via pinfo->private_data or others?


No.
There is, BTW, no guarantee that there will *be* TCP (although it's likely to be there, as it's probably not running atop NBF, or any of the other older transports atop which SMB runs), or NBT (although the SMB-over-TCP wrapper is equivalent) or, if the service can run atop non-SMB transports, any of the stuff above DCE RPC. 

It might, at some point, run over SMB2 as well.
There might also be transaction-layer (or DCE layer?) reassembly, so the stub data might be a chunk of reassembled data, with more than one NBT header.