Wireshark-dev: Re: [Wireshark-dev] tvb buffer
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 9 Jun 2008 18:41:12 -0700

On Jun 8, 2008, at 11:22 PM, Abhik Sarkar wrote:

If I am not mistaken, the tvb is first created in the dissect_packet
function of epan/packet.c.

Yes:

	edt->tvb = tvb_new_real_data(pd, fd->cap_len, fd->pkt_len);