Hi,
I am trying to make a plugin for Wireshark which makes some statistics about captured packets. The basic things work: it can count packets, use the tap to send information collected while dissecting to the stats plugin and do some other stuff using the stats_tree functions.
Now I have the following situation:
- My own dissector for my protocol
- My stats plugin for my protocol
- Another protocol (802.11) which my protocol encapsulates - I haven't written the dissector for this one - it is already included in Wireshark.
When I try to do some more advanced stuff I run into a couple of problems. The main problem is that I'd like to be able to access the tree (or at least some information, like sequence number of packet, data of ACK etc.) of the protocol which I have encapsulated (802.11). I can't save the 'tree' variable in my dissector to the tap information or to the private_data field, because it seems that when the stats plugin is called, the dissector is also called with tree=NULL, so it skips the whole tree creating part.
I guess I either need to get Wireshark to also create the tree when it calls my stats plugin, or find some other way to get the information about the protocol mine encapsulates. Unfortunately I have no clue how to do that. Does anyone here has the knowledge how something like this can be achieved?
Thanks,
Floris
