Wireshark-dev: Re: [Wireshark-dev] Obtaining protocol offsets from dissection results
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 05 Jun 2008 22:10:48 -0700
Eloy Paris wrote:


For each layer (protocol) in a packet I need to obtain the offset into
the packet. For example, for "eth:ip:icmp:data", the offsets would be:

    eth:   0
    ip:   14 (IP with no options)
    icmp: 34 (ICMP echo request)
    data: 42

I have been using the value of the "start" field of "struct field_info"
(epan/proto.h). However, I just found out that in some cases "start" can
be zero.
"Some cases" includes any case where you have reassembly - whether IPv4/v6 fragmentation reassembly, reassembly of packet chunks in a TCP stream, etc..
It also includes cases where you have compressed packet data that's decompressed before dissection (in which case it's not clear what the offset would mean) or encrypted packet data that's decrypted before dissection. 

I.e., the general problem is insoluble.  What is it you're trying to do?