Wireshark-dev: Re: [Wireshark-dev] What is the best way to create a stateful dissector?
On 11/22/2011 7:02 PM, Bill Meier wrote:
So, it may be the case that you'll need to store "per-frame" info about
any decisions made as to how to dissect a particular packet based upon a
previous packet.
When an arbitrary packet is then dissected again later the associated
per-packet info is used to do the dissection in the same way as done
during the first sequential pass.
Or: If the nature of the state info is akin to "setup" info which once
seen applies to all the following packets of a conversation then use of
a conversation should be sufficient.
(Of course your dissector will need to handle the case wherein a capture
"starts in the middle" such that info from a previous packet is not
available).
If the state info can be different for each of the streams then you may
want to use a GHashtable associated with a conversation to store info
for each individual stream associated with a conversation (connection).
