Wireshark · Ethereal-dev: RE: [Ethereal-dev] How to access low layer raw data when I decode the high layer pro tocol

[Liu Chunfang-CCL083 <ChunfangLiu@xxxxxxxxxxxx>]

Maybe I gave a bad example. But I really want to know how to access low layer raw data when I decode the high layer protocol. Does the tvb_buffer have some functions to do that? 

-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx] 
Sent: Thursday, August 05, 2004 4:20 PM
To: Liu Chunfang-CCL083
Cc: ethereal-dev@xxxxxxxxxxxx
Subject: Re: [Ethereal-dev] How to access low layer raw data when I decode the high layer pro tocol


Liu Chunfang-CCL083 said:
> Does anyone know if I can access low layer raw data when I decode the 
> high layer protocol, for example, when I decode some protocols above 
> TCP, I need to access ETHERNET address?

There is no broad guarantee that there *is* an Ethernet address when you're decoding a protocol above TCP - TCP runs atop IP, which is a routable protocol, so even if you happen to send it over Ethernet on the first hop it might be routed over PPP, for example.

As such, I'm not sure why your dissector would *need* the Ethernet address; what are you trying to do there?