Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Buffering packets for dissection

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Mon, 26 Jul 2010 17:06:51 +0200
Hi,

What's your transport protocol?

Thanks,
Jaap

On Mon, 26 Jul 2010 16:29:42 +0300 (EEST), andreas.akesson@xxxxxxxxxxx
wrote:
> Hello,
> 
> I'm currently writing a dissector which requires packet buffering to
> work. The dissector more or less has to brute-force the packet stream
> to find the actual data, but it needs at least a dozen packets of data
> before it can do anything. So, it doesn't know when the data begins,
> and how much data it needs (there is a maximum possible length
> though).
> 
> Is there any built-in support for this? I was able to store the tvb
> buffers into a circular buffer, but I'm not quite sure what to do with
> the packet_info structure (I may be wrong, but it didn't seem to be on
> the heap, so I couldn't just store the pointer to it).
> 
> Any help is appreciated!
> 
> Sincerely,
> Andreas
>