ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Check of DSCP/TOS field in tunnelled frame

From: Andrej Mikus <wireshark-dev@xxxxxxxx>
Date: Tue, 13 Mar 2007 22:05:20 +0100
Team,

I am looking into a way to compare IP DSCP value in the header of IP GRE
frame with the value of the field in encapsualeted packet.

Both headers are handled by IP dissector, is there any mechanism
available to help to find out level of recursion? Top level should store
the field somewhere (packet_info, perhaps in private_data as suggested
at http://www.wireshark.org/lists/wireshark-dev/200703/msg00141.html)
and when dissecting the inner frame this information can be used.

Considering more levels of encapsulation is not needed at this point...

I am using flag in_error_pkt for similar purpose already, when I set it
in GRE dissector, next level of IP behaves differently, in fact exactly
how I needed.

For the issue in subject, perhaps just adding a new value into
packet_info (next to srcport and other dissector specific values) and
using magic number ~0 to indicate top level could help here. Another
value would need to get passed from GRE dissector to activate this check
in IP...

I would appreciate any suggestion.

Many thanks for your kind cooperation.

Andrej Mikus