Wireshark-dev: Re: [Wireshark-dev] Buffering packets for dissection
From: Jaap Keuter <[email protected]>
Date: Mon, 26 Jul 2010 17:06:51 +0200

What's your transport protocol?


On Mon, 26 Jul 2010 16:29:42 +0300 (EEST), [email protected]
> Hello,
> I'm currently writing a dissector which requires packet buffering to
> work. The dissector more or less has to brute-force the packet stream
> to find the actual data, but it needs at least a dozen packets of data
> before it can do anything. So, it doesn't know when the data begins,
> and how much data it needs (there is a maximum possible length
> though).
> Is there any built-in support for this? I was able to store the tvb
> buffers into a circular buffer, but I'm not quite sure what to do with
> the packet_info structure (I may be wrong, but it didn't seem to be on
> the heap, so I couldn't just store the pointer to it).
> Any help is appreciated!
> Sincerely,
> Andreas