Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] How to extract data from earlier dissectors for thesame packe

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Ronnie Sahlberg" <rsahlber@xxxxxxxxxxxxxx>
Date: Mon, 12 Mar 2001 07:20:19 +1100
Hi,

The dissector I am looking at right now is packet-mount.c
In dissecting say MOUNT RES there is a fh structure returned,
when this structure is dissected, I would like to match it with the
XID field of the previous dissector for RPC and IP.SADDR from the previous
dissector for IP.

IP.SADDR would allow me to know which NFS server the mount was performed on
and
XID would allow me to match with the coresponding MOUNT MSG which would
allow me to
find out which mountpoint on said NFS server we mounted.
This would then allow me to match the filehandle in fh with
a.b.c.d//mount/point

I dont want to place globals in the dissectors from ip and rpc since this
would be ugly,
and I dont know where the IP or RPC headers start unless I completely
dissect these headers and calculate the
lengths which would be redundant (has already been done by the real
dissectors).

If no better solution is available, I could add globals which IP and RPC
would fill in when dissecting their
parts of the packet and just read them from MOUNT, though this would be very
ugly and I am quite
sure it would not be allowed to enter the mainstream code.

best regards
    ronnie s


----- Original Message -----
From: "Richard Sharpe" <sharpe@xxxxxxxxxx>
To: "Ronnie Sahlberg" <rsahlber@xxxxxxxxxxxxxx>; <ethereal-dev@xxxxxxxxxxxx>
Sent: Sunday, March 11, 2001 11:25 PM
Subject: Re: [Ethereal-dev] How to extract data from earlier dissectors for
thesame packet?


> At 10:02 PM 3/11/01 +1100, Ronnie Sahlberg wrote:
> >
> >Hi,
> >
> >I am playing with a dissector, however, when dissecting the packets in
this
> >protocol
> >it would be very convenient to have access to the data extracted by
> >lower-layer dissectors for
> >thge same packet.
> >Is this possible, and how would I access this data?
> >
> >Assume I dissect a layer-5 protocol, would it be possible from this
> >dissector to access
> >say the ip.saddr  field of the underlying ip-dissector which has already
> >dissected the ip-layer?
>
> There is a global that gives you access to this stuff ... Have a look at
> the IP and TCP dissectors ...
>
> >Something like
> >ptr=find_value_in_packet(current_packet_id(),"ip.saddr");
>
> I don't think we have gotten around to that yet.
>
> What dissector are you doing?
>
> >---
> >second question,
> >assume I would need to reset some datastructures before a capture is
started
> >or loaded from file,
> >is there a common routine where I can add calls to my "clean up previous"
> >and "prepare for new data"
> >routines?
> >
> >best regards   ronnie s
> >
> >
> >_______________________________________________
> >Ethereal-dev mailing list
> >Ethereal-dev@xxxxxxxxxxxx
> >http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
>
> Regards
> -------
> Richard Sharpe, sharpe@xxxxxxxxxx
> Samba (Team member, www.samba.org), Ethereal (Team member,
www.ethereal.com)
> Contributing author, SAMS Teach Yourself Samba in 24 Hours
> Author, Special Edition, Using Samba
>
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>