Wireshark-dev: Re: [Wireshark-dev] Accessing TCP headers from dissector
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 20 Aug 2011 11:11:27 -0700
On Aug 20, 2011, at 2:56 AM, Brian White wrote:

> I am writing a dissector (my first try) and I would like to get at the underlying TCP header of each packet I dissect (specifically the acknowledgement number).

In what way would your dissector use this information?  Implementations of the protocol your dissector is dissecting cannot, on most if not all OSes, see the ack number, as TCP just presents to protocol implementations running atop it a sequenced data stream, with no TCP segment boundaries or sequence or acknowledgment numbers visible.