Wireshark-dev: Re: [Wireshark-dev] Obtaining protocol offsets from dissection results
From: Guy Harris <[email protected]>
Date: Thu, 05 Jun 2008 22:10:48 -0700
Eloy Paris wrote:

For each layer (protocol) in a packet I need to obtain the offset into
the packet. For example, for "eth:ip:icmp:data", the offsets would be:

    eth:   0
    ip:   14 (IP with no options)
    icmp: 34 (ICMP echo request)
    data: 42

I have been using the value of the "start" field of "struct field_info"
(epan/proto.h). However, I just found out that in some cases "start" can
be zero.
"Some cases" includes any case where you have reassembly - whether 
IPv4/v6 fragmentation reassembly, reassembly of packet chunks in a TCP 
stream, etc..
It also includes cases where you have compressed packet data that's 
decompressed before dissection (in which case it's not clear what the 
offset would mean) or encrypted packet data that's decrypted before 
I.e., the general problem is insoluble.  What is it you're trying to do?