Wireshark · Wireshark-dev: Re: [Wireshark-dev] Data from previous protocol

[Guy Harris <guy@xxxxxxxxxxxx>]

ali alkhalidi wrote:
> well, I'm trying to to verify an AH packet.

Do you mean validating the authentication data?

If so, then the way to do this would be to modify the IPv4 and IPv6 
dissectors to pass the relevant information to subdissectors via the 
pinfo->private_data pointer.

pinfo->private_data would point to a data structure with:

	a Boolean that's TRUE for IPv6 and FALSE for IPv4;

	a "const char *" pointer to the IPv4/IPv6 header (fetched with 
tvb_get_ptr());

	 the length of the header, in bytes.

Some dissectors would ignore this; the TCP and UDP dissectors could use 
that to do checksum validation (currently, they fetch that information 
from other pinfo fields); the AH dissector would use copy the header to 
a private buffer, zeroing out the appropriate fields, and use that.