Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Request/Response tracking with multiple responses

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 20 Jun 2008 10:26:44 -0700
Thomas Boehne wrote:
I followed the README.request_response_tracking to add
request/response tracking to a UDP based protocol, but the protocol
sometimes sends multiple responses to a single request. Does anybody
know of a dissector that handles this case properly, so that I could
take a look at the code?

I don't know of any. I don't know of many protocols where multiple responses are sent to a single request (other than responses sent to retransmitted requests).

Or is it basically just a matter of extending the pana_transaction_t
struct (see below) to handle a list of replies, and then iterate
through it?

typedef struct _pana_transaction_t {
                guint32 req_frame;
                guint32 rep_frame;
                nstime_t req_time;
        } pana_transaction_t;

I.e., instead of a guint32 rep_frame, have a list of frames, or a GArray of frame numbers, or something such as that?

That's probably the right answer.