Wireshark · Wireshark-dev: [Wireshark-dev] tvb_composite

["Yosi Saggi" <yosis@xxxxxxxxxxxxxxxxxxxxx>]

Hi

I have a question about the “tvb_composite…” functions.

I have an Ethernet message that comes in chunks. All of the payload is in the Ethernet message, just divided to several chunks of data.

I have used “tvb_composite_append” function to collect all the chunks into one tvb. And used the “tvb_composite_finalize” to finalize the tvb.

The problem is that the new tvb has no “real_data” inside. Therefore I can’t use any “tvb_get..” functions.

I have also noticed that the (tvbuff_t*)new_tvb->used_in->data is the end of the buffer and not the beginning. If it was the beginning I could have used that. It doesn’t matter if I use prepend or append the result is the same.

I have 3 chunks’ meaning the usage count is = 4. The beginning of the data is at (tvbuff_t*)new_tvb->used_in->next->next->data, why is that?

 

Is there a way to use the finialized new_tvb buffer as I would use any subset_tvb ?

 

Yosi