Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] How to get absolute frame/packet index in buffer?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 18 Oct 2007 11:45:07 -0700
Sebastien Dubois wrote:

I'm currently developping a plugin and I have a little question: Is it possible, from a given dissector, to get the number of bytes already dissected by lower-layer dissectors ? In other words, can I get the index relative to start of a frame/packet buffer? From my dissector point of view, for instance, the relative index to the start of the tvbuff passed to it is of course 0, which could be let's say index 50 relative to the absolute start of the ethernet frame/packet.

What if the packet your dissector has been given has been reassembled from data in multiple link-layer frames? In that case, it's not clear the question you're trying to ask in your dissector *has* an answer.

What are you planning to do with that value?