On Dec 8, 2006, at 8:15 AM, Jaap Keuter wrote:
Let me point you in the direction of conversations. This is a concept
described in doc/README.developer. It comes down to attaching your
data to
a source/destination address/port pair, which you then can retrieve
while dissecting subsequent packets.
Note also that if dissecting packet N in a conversation requires
information about packet N-1, the conversation can be used for this on
the first pass through the file, but, as there's no guarantee that you
will be dissecting packet N-1 before dissecting packet N (that's only
guaranteed on the first pass when the file is read in), you will need
to attach the relevant information to packet N on the first pass,
using the "Per packet information" mechanism - see section 2.5 in doc/
README.developer.
