Patrick Fuchs wrote:
I want to compare some data from the actual packet with data from the
previous packet.
By "data from the actual packet" you mean raw packet data?
If so, note that the per-packet data structure has in it what the
dissector put there; the dissector would have to put raw packet data there
in order for you to be able to fetch it.
yes, i mean raw packet data, e.g. two guint8-values.
Note also that "previous packet", as noted, is the previous packet in the
file, which isn't necessarily the previous packet for your protocol.
so i want to know, if there is a possibility to access data from the
previous packet in a conversation!. The packets of the protokoll i want
to dissect are always reaktions of the
previous packet. And so the previous packet in the conversation should
always be the
previous packet of the protokollflow (or if not, i could determine it
by this way)
Are you doing this in a dissector or in a tap?
I want to do this in a dissector.
