Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Dissectors and parsing mode

From: "Chris Davies" <meiows@xxxxxxxxx>
Date: Sat, 8 Nov 2008 01:01:31 +0000
2008/11/8 Stephen Fisher <stephentfisher@xxxxxxxxx>:
> You're probably running into the situation where the color filters are
> enabled.  This causes the tree to be non-null even when a packet isn't
> selected.  Turn off color filters and try again.  Simply put things that
> need to be processed at all times outside of the if(tree).

Thanks, I did that and I did indeed get null tree pointers on the
first run through. I guess this means that's exactly the way it is
supposed to work.

So, next question. Is there a handy-dandy way of storing some data per
packet somewhere? What I'd really like to do is in my first run
through of every packet in order (where I do the initial reassembling
of fragmented PDUs) is store a list of which PDUs each discrete packet
contains, so when someone clicks on the item in the GUI to get more
info, I can just look at that info and parse those particular PDUs in
order rather than attempting to divine on the fly what PDUs a packet
contains.

I did see some vague references on this mailing list to being able to
store something like this in the packet_info structure, but I can't
see how to do that from looking at the header.

Thanks,
      Chris