Wireshark · Wireshark-dev: Re: [Wireshark-dev] Using wireshark protocol parsers to build packets

[Guy Harris <guy@xxxxxxxxxxxx>]

[Chris] NULL wrote:

> My question is, is it possible to use the Wireshark disectors to "build" a 
> trace. What I mean with this is, is it e.q. possible to change values in the 
> Wireshark GUI and then have Wireshark build the binary trace together? I 
> know that in the current version this is not possible, but my question is in 
> general. Is it possible to extend the Wireshark disectors to be able to 
> "build" a trace?

No; that feature's missing from the current version because the 
infrastructure for it isn't available, not because Wireshark chooses not 
to implement it.

This is probably significantly more complicated than one might think, 
especially given packet reassembly.  A mechanism to do that would be 
useful for manually editing packets (e.g., to construct a sequence of 
packets to replay), as well as for the anonymization feature another 
person would like to implement - but it'd require architectural work.