Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Dissector question

From: Evan Huus <eapache@xxxxxxxxx>
Date: Sun, 10 Mar 2013 13:30:48 -0400
On Sun, Mar 10, 2013 at 1:24 PM, David Arnold <davida@xxxxxxxxx> wrote:
> On 10/03/2013, at 5:13 PM, Evan Huus wrote:
>
> Hi Evan,
>
> Thanks for your help.
>
> <...>
>
>> I'm not sure I follow this. Can't you simply store the most recent
>> sequence number in the conversation struct, and increment it for each
>> PDU received?
>
> I tried to do this, and perhaps I just got it (slightly) wrong.
>
> In my foo_dissect() function, I looked up the conversation, grabbed the latest sequence number, incremented it, and wrote it back to the conversation.  I displayed it in the tree_item for the PDU, and in the COL_INFO, which was basically what I was after.
>
> The issues I had seemed to be related to when my dissection function was called: if I scrolled from start to end of the capture, it was fine.  If I jumped to the final frame, the sequence number wasn't incremented for the intervening PDUs.
>
> Perhaps I need it to be done outside my  if (tree) { ... } ?

Yes, definitely. In general, the only things done in an if (tree)
block should be adding things to the tree. Any other tasks (setting
column information, reassembly, conversation management, etc.) should
be done regardless.