Wireshark-dev: Re: [Wireshark-dev] Problem by writing a plugin, how to access the previous tele
From: Guy Harris <[email protected]>
Date: Fri, 8 Dec 2006 13:51:11 -0800
On Dec 8, 2006, at 8:15 AM, Jaap Keuter wrote:

Let me point you in the direction of conversations. This is a concept
described in doc/README.developer. It comes down to attaching your data to
a source/destination address/port pair, which you then can retrieve
while dissecting subsequent packets.
Note also that if dissecting packet N in a conversation requires  
information about packet N-1, the conversation can be used for this on  
the first pass through the file, but, as there's no guarantee that you  
will be dissecting packet N-1 before dissecting packet N (that's only  
guaranteed on the first pass when the file is read in), you will need  
to attach the relevant information to packet N on the first pass,  
using the "Per packet information" mechanism - see section 2.5 in doc/