Wireshark · Wireshark-dev: [Wireshark-dev] tapping and access to fields

["Mikael Wikström" <leakim.wikstrom@xxxxxxxxx>]

Hi,

I'm trying to write a tap to calculate some statistics based on values
found in multiple frames in one or more packets. I want to be able to
access some values from the prism/radiotap, for example
radiotap.rate/prism.rate.data, and wlan.type_subtype from the wlan
frame. Writing a tap for the wlan protocol gives me a basic static
context with some useful generic wlan fields but how to I access the
other fields?

1. What is the best way of accessing a field from a frame that is not
in my static protocol dependent tap context?

2. How do I access (1) of the previous frame in my tap?

I think the answer to these two questions will be very helpful to have
in the README.tapping.

In this mail I am referring to packets as in a single captured packet
and frames as (radiotap/ieee80211/ip/udp) frames  in that package.