Wireshark · Wireshark-dev: Re: [Wireshark-dev] Request/Response tracking with multiple responses

[Guy Harris <guy@xxxxxxxxxxxx>]

Thomas Boehne wrote:
> I followed the README.request_response_tracking to add
> request/response tracking to a UDP based protocol, but the protocol
> sometimes sends multiple responses to a single request. Does anybody
> know of a dissector that handles this case properly, so that I could
> take a look at the code?

I don't know of any.  I don't know of many protocols where multiple 
responses are sent to a single request (other than responses sent to 
retransmitted requests).

> Or is it basically just a matter of extending the pana_transaction_t
> struct (see below) to handle a list of replies, and then iterate
> through it?
>
> typedef struct _pana_transaction_t {
>                 guint32 req_frame;
>                 guint32 rep_frame;
>                 nstime_t req_time;
>         } pana_transaction_t;

I.e., instead of a guint32 rep_frame, have a list of frames, or a GArray 
of frame numbers, or something such as that?

That's probably the right answer.