Wireshark-dev: Re: [Wireshark-dev] Start Dissection from an upper layer?
From: "Abhik Sarkar" <[email protected]>
Date: Tue, 10 Jun 2008 17:04:43 +0400
Hi Guillaume,

Perhaps if you can figure out how this mechanism works -
http://wiki.wireshark.org/HowToDissectAnything, you could use a
similar approach. You could also check wiretap/wtap.h to see if the
API you have been provided can produce frames in one of the known


On Tue, Jun 10, 2008 at 3:25 PM, Guillaume Bienkowski
<[email protected]> wrote:
> Hello Guys,
> I have successfully written a program that uses the Wireshark Lib to
> dissect some packets.
> The thing is, through the API I was given from my boss, I can only
> receive informations from the 3rd layer (IPv4, IPX, ... layer), which
> confuses the dissectors, and screws the dissection.
> One solution would be to allocate a temporary buffer which would include
> my 3rd layer and above, plus a fake header from the 2 bottom layers; but
> this would mean that I'd have to allocate memory for every packet... not
> really optimized..
> Is it possible to use epan_dissect_run() from an upper layer, telling
> the library to start dissecting from a packet that has already been
> shortened?
> Thanks in advance,
> Guillaume
> _______________________________________________
> Wireshark-dev mailing list
> [email protected]
> https://wireshark.org/mailman/listinfo/wireshark-dev