Ethereal-dev: Re: [Ethereal-dev] access to previous packet data

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Tue, 21 Mar 2006 15:25:26 -0800 (PST)
Patrick Fuchs wrote:
> I want to compare some data from the actual packet with data from the
> previous packet.

By "data from the actual packet" you mean raw packet data?

If so, note that the per-packet data structure has in it what the
dissector put there; the dissector would have to put raw packet data there
in order for you to be able to fetch it.

Note also that "previous packet", as noted, is the previous packet in the
file, which isn't necessarily the previous packet for your protocol.

Are you doing this in a dissector or in a tap?