Wireshark-dev: Re: [Wireshark-dev] parent level tvb access for fragmented and compiled packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "khushbu thakkar" <thakkar.khushbu@xxxxxxxxx>
Date: Thu, 13 Mar 2008 09:22:29 +0530
Thanx for the response.
By parent-level tvb i meant top level tvbuff.
I need Destination IP Address and Differentiated Service Field from IP layer. Can it be possible to get.
 
Reply Soon,
Thank You,
Khushbu 

On Wed, Mar 12, 2008 at 11:08 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
khushbu thakkar wrote:

> Now my question is if we have have a UDP packet compiling fragmented IP
> packets eg: Frame no. 33 of attached file. With the statement
> "tvb->ds_tvb" we can get access to parent-level tvb. But for fragmented
> and compiled frames as no. 33 this does not work. So for such fragmented
> and compiled packets how to get the parent level tvb.

What do you mean by "the parent-level tvb"?

If IP reassembly is enabled, the *only* tvbuff handed to the UDP
dissector is a tvbuff containing the payload of the reassembled IP
datagram.  You do not have access to the tvbuffs - plural! - for the IP
fragments that were reassembled.

What information do you need from the IP layer?
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev