Wireshark · Ethereal-dev: Re: [Ethereal-dev] LEGO: How acces to a previous pdu data

[Ulf Lamping <ulf.lamping@xxxxxx>]

Jose M. Pardo wrote:
> Hello list,
>
> I�m new developing on Ethereal and I have a couple of questions that I 
> hope that someone can answer.
>
> I have to dissect a PDU_B according some data stored in a previous PDU_A.
>
> How can I access to this data?
>
> One step beyond�.if I apply a filter and the PDU_A is hidden. Can I 
> fetch those data or are they unavailable?
>
> There�s in the source code a protocol dissector that works in this way?
AFAIK, you can't directly access data from any previous packet that is 
mostly because at least tethereal uses a single pass approach.

However, what you can do is keeping the relevant data in a conversation 
which is spanning multiple packets.

How to do this is beyond my knowledge, you may have a look at the places 
mentioned in: http://wiki.ethereal.com/Development

Regards, ULFL