ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] How to get absolute frame/packet index in buffer?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 18 Oct 2007 11:45:07 -0700
Sebastien Dubois wrote:

I'm currently developping a plugin and I have a little question: Is it possible, from a given dissector, to get the number of bytes already dissected by lower-layer dissectors ? In other words, can I get the index relative to start of a frame/packet buffer? From my dissector point of view, for instance, the relative index to the start of the tvbuff passed to it is of course 0, which could be let's say index 50 relative to the absolute start of the ethernet frame/packet.

What if the packet your dissector has been given has been reassembled from data in multiple link-layer frames? In that case, it's not clear the question you're trying to ask in your dissector *has* an answer.

What are you planning to do with that value?