Wireshark-dev: Re: [Wireshark-dev] Dissector for stream data
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andreas <AndreasSander1@xxxxxxx>
Date: Sun, 25 Dec 2011 06:35:42 +0100
Am 24.12.2011 14:16, schrieb Andriy Beregovenko:

If I open dump, select frame, and push 'END' I move to end of dump.
At this time all frames between first few frames and few last frames, not
decoded, so I can't correct decode last frame.
Question is: how I can walk through all frames that will be passed to
dissector if we look frames one-by-one?
Wireshark passes all packets in order to the dissector, when the capture is loaded. After this the dissector will get the packets in arbitrary order.
The dissector can distinguish between both calls (see PINFO_FD_VISITED macro) and build conversation information in the first phase. 

Andy