Wireshark-dev: Re: [Wireshark-dev] Undissected packet bytes
From: Evan Huus <[email protected]>
Date: Wed, 4 Feb 2015 11:25:24 -0500
I think you will need to add a function very similar to
proto_find_field_from_offset that makes use of
proto_tree_traverse_pre_order and tracks which bytes have been "seen"
as the traversal proceeds.

On Wed, Feb 4, 2015 at 11:22 AM, Dario Lombardo
<[email protected]> wrote:
> On Wed, Feb 4, 2015 at 3:52 PM, Evan Huus <[email protected]> wrote:
>>
>>
>> As a side note, I would expect that method to be *very* slow, since it
>> traverses the entire tree for every byte of the packet. Traversing the
>> tree once and maintaining a set of covered/uncovered ranges would be
>> much more efficient.
>
>
> I can't figure out how to traverse the tree once.
>
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <[email protected]>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:[email protected]?subject=unsubscribe