Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Protocol Col / Info col error

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 31 Mar 2009 10:54:35 -0700

On Mar 31, 2009, at 10:45 AM, vinayak kamath wrote:

  iDataLen = tvb_length(tvb); /* get length of packet */

That's the amount of captured packet data in the packet, which could be smaller than the length of the packet, as the capture might have been done with a "snapshot length" or "slice length" that caused a maximum of N bytes of packet data to be captured, discarding all the data following it.

You want tvb_reported_length().

if ( IsABCMessage(tvb, iDataLen)) /* check if it is a ABC message */
{
if (check_col(pinfo->cinfo,COL_PROTOCOL)) // #######This is NULL, asa a result it doesn't enter the if condition

What is the "This" in "This is NULL"? check_col() returns a Boolean value, not a pointer, so it's true or false, not null or non-null.

Note also that check_col() will not always return true - it should do so the first time the dissector is called, but won't necessarily be true on times it's called after that. (And it's possible that, in the future, it won't return true the first time the dissector is called.)