ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] basic questions about writing dissectors

From: Martin Kaiser <lists@xxxxxxxxx>
Date: Sun, 26 Feb 2012 15:20:13 +0100
Dear all,

I'm playing with some enhancements to my dissectors, some basic
questions came up:

Is it possible to add an element in the packet tree that has an hf entry
and can be filtered but does not have a corresponding tvb? I'm looking
at getting info from a circuit and add this to the tree as a filterable
element. For now, I read from the circuit, create a tvb, add another
data source for the tvb and dissect it. I was wondering if there's a
cleaner solution without adding a data source. (It looks like a tvb
that's not part of the packet itself needs a new data source).

It seems that a lot of dissectors use pinfo->fd->num without a previous
check "if (pinfo && pinfo->fd)". Is it safe to do so?

For se_malloc(), do I have to check the return value for NULL? I recall
that for g_malloc(), there's no need for a NULL check, the programs is
terminated when there's no memory.

Thanks in advance for your help,

   Martin