Wireshark-dev: Re: [Wireshark-dev] questions about conversations
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Tomasz Noiński <noix@xxxxxxxxx>
Date: Thu, 17 May 2007 11:08:57 +0200
On Wed, 16 May 2007 15:48:36 -0700
Guy Harris <guy@xxxxxxxxxxxx> wrote:

> On May 16, 2007, at 12:58 PM, Tomasz Noiński wrote:
> 
> > Did I get this wrong? Is it possible to create Wireshark "frames" from
> > inside a dissector?
> 
> No.
> 
> Perhaps we need to have the key for the protocol data routines be a  
> frame number and an offset within the frame, so that there can be  
> multiple protocol data items within a link-layer frame.

I think "offset within a frame" might be not enough:
For example, in my case, I decode the packets first, creating a nev tvb
with tvb_new_real_data().
So, unless there's some tvb-magic I don't know about, simple offset
just isn't enough.

Numbering packets manually inside a frame (for example, as an
alternative to providing an offset, as Steve suggested) might be the
best solution...

Noix