Wireshark · Ethereal-dev: Re: [Ethereal-dev] How can I get offset of some field from tcp data zone?

[Guy Harris <gharris@xxxxxxxxx>]

scz wrote:
> In some sub dissector, for example:
>
> TCP
>     NBT
>         SMB
>             DCE/RPC
>                 stub data
>
> I'm unmarshaling the stub data, and want to show offset to &NBT in graphic
> tree. Can I get/compute the offset via pinfo->private_data or others?

No.

There is, BTW, no guarantee that there will *be* TCP (although it's 
likely to be there, as it's probably not running atop NBF, or any of the 
other older transports atop which SMB runs), or NBT (although the 
SMB-over-TCP wrapper is equivalent) or, if the service can run atop 
non-SMB transports, any of the stuff above DCE RPC.

It might, at some point, run over SMB2 as well.

There might also be transaction-layer (or DCE layer?) reassembly, so the 
stub data might be a chunk of reassembled data, with more than one NBT 
header.