Wireshark-dev: Re: [Wireshark-dev] Retrieving dissection result from another dissector
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 5 Jul 2018 00:53:21 -0700
On Jul 5, 2018, at 12:34 AM, Dario Lombardo <lomato@xxxxxxxxx> wrote:

> What about, instead, introducing a new field in pinfo? Something like "result from dissection of the next proto in the stack, reported to the previous"?

That's like a restricted-to-one-element version of the already-existing pinfo->proto_data (that's the list that p_add_proto_data() adds to if passed pinfo->pool as the scope).

> The function p_data_dissection_get() would give the caller the saved data back and set the field to NULL, so it cannot be retrieved again by other protos in the stack.

Is there some reason to forbid dissectors called by the dissector for the next protocol in the stack to fetch that data?