Wireshark-dev: Re: [Wireshark-dev] Encapsulated IP
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Mon, 20 Sep 2010 11:34:50 -0600
On Mon, Sep 20, 2010 at 10:22:45AM -0700, Ronald Howe wrote:

> Hello I am new and have a question about the IP dissector. I have 
> written a plug-in for my work and one of the packets has encapsulated 
> IP. I call the IP dissector and that works fine my question is there 
> any way to call the dissector and not have it update the source and 
> destination fields? Can I lock those before I call the dissector?

This may work:

  col_set_writable(COL_DEF_SRC, FALSE);
  col_set_writable(COL_DEF_DST, FALSE);

Those are the two default source and address columns that Wireshark 
uses.  The user may have defined other source/destination columns (such 
as unresolved or custom columns) that this wouldn't affect.

You can also call col_get_writable(COL_xxx) (or use the macro 
COL_GET_WRITABLE directly) to check if a column is writable.  These 
functions are in epan/column-utils.h.