Wireshark-dev: Re: [Wireshark-dev] parent level tvb access for fragmented and compiled packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 12 Mar 2008 10:38:15 -0700
khushbu thakkar wrote:
Now my question is if we have have a UDP packet compiling fragmented IP packets eg: Frame no. 33 of attached file. With the statement "tvb->ds_tvb" we can get access to parent-level tvb. But for fragmented and compiled frames as no. 33 this does not work. So for such fragmented and compiled packets how to get the parent level tvb. 

What do you mean by "the parent-level tvb"?
If IP reassembly is enabled, the *only* tvbuff handed to the UDP dissector is a tvbuff containing the payload of the reassembled IP datagram. You do not have access to the tvbuffs - plural! - for the IP fragments that were reassembled. 

What information do you need from the IP layer?