ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Buffering packets for dissection

Date: Mon, 26 Jul 2010 16:29:42 +0300 (EEST)
Hello,

I'm currently writing a dissector which requires packet buffering to work. The dissector more or less has to brute-force the packet stream to find the actual data, but it needs at least a dozen packets of data before it can do anything. So, it doesn't know when the data begins, and how much data it needs (there is a maximum possible length though).

Is there any built-in support for this? I was able to store the tvb buffers into a circular buffer, but I'm not quite sure what to do with the packet_info structure (I may be wrong, but it didn't seem to be on the heap, so I couldn't just store the pointer to it).

Any help is appreciated!

Sincerely,
Andreas