Wireshark · Wireshark-dev: Re: [Wireshark-dev] finish of dissecting

["Илья Куделин" <iliya.kudelin@xxxxxxxxx>]

thanx a lot for answer.
 

For a dissector there's no such thing like a last packet, the
dissector has to behave as if another packet was to come. For a tap
listener there's neither sucha concept it has to behave as there could
still be more packets coming.

Ususally tap listeners are made arround two calls one that takes care
of every packet and another one that is periodically invoked to draw
the results (in the case of tshark it is called after all packets are
processed) .

The file doc/README.tapping in the source ditribution describes how to
write a tap.


On 8/29/07, Илья Куделин <iliya.kudelin@xxxxxxxxx> wrote:
> Hi.
> Tell me please, how can i know that wireshark is finished dissecting packets
> in trace, when trace load into wireshark? i write plugin, and i need know
> then last packet from trace was processed.

-- 
С уважением,
Илья Куделин mailto:
iliya.kudelin@xxxxxxxxx
icq#                   154801384
jabberID             iliya@xxxxxxxxxxxxx