Wireshark · Wireshark-dev: Re: [Wireshark-dev] Storing information to show it in future packets

[Graham Bloice <graham.bloice@xxxxxxxxxxxxx>]

On 15 September 2015 at 14:07, Juan Jose Martin Carrascosa <juanjo@xxxxxxx> wrote:

Hi everyone,

I wonder which would be the best way to store information gathered from captured packets so I can show it in packets captured after.

To give some context... in the RTPS protocol, information about the Writers of the data is provided in the discovery phase (Type of data, configuration, etc.). This phase happens at the beginning of the communication.

After that, when user data samples are sent they just contain the Writer ID. I would like to know, with regards to performance, which is the best way to store the data and retrieve it. For instance, any kind of hash table? Ideally, I would store all the information in something like this:

struct WriterInfo {

    inner_struct writer_id; <<<<<<<<< key

    string my_info_string;

    string my_other_info_string;

    gint my_info_int;

...

};

I have already a prototype up and running but I think that this is far from being the best approach.

Regards,

Juanjo Martin

You probably want to look at conversations in README.dissector, especially conversation_add_proto_data and conversation_get_proto_data.

--

Graham Bloice