ok Can I then use SET_ADDRESS to put the Source and Destination fields back to the original IP address not the encapsulated Address? That would be more useful to the guys using the tool.
thanks Ron ________________________________________ ge: 5 Date: Mon, 20 Sep 2010 17:16:39 -0700 From: Ronald Howe <[email protected]> Subject: Re: [Wireshark-dev] Encapsulated IP To: "[email protected]" <[email protected]> Message-ID: <[email protected]> Content-Type: text/plain; charset="us-ascii" The col_set_writable does not seem to make a difference in the source and destination address They seem to update when I call the ip dissector again. If I could read those columns before I call the dissector I could replace the fields when it returns but I don't see a function in column-utils.h to do that. ------------------------------ Message: 6 Date: Mon, 20 Sep 2010 17:25:26 -0700 From: Guy Harris <[email protected]> Subject: Re: [Wireshark-dev] Encapsulated IP To: Developer support list for Wireshark <[email protected]> Message-ID: <[email protected]> Content-Type: text/plain; charset=us-ascii On Sep 20, 2010, at 5:16 PM, Ronald Howe wrote: > The col_set_writable does not seem to make a difference in the source and > destination address Nope. The columns are set based on the addresses set by SET_ADDRESS, and we do not allow a dissector to prevent another dissector from setting the address (if your dissector were to prevent the IP dissector from setting the address, that would violate assumptions, made by dissectors running atop IP and atop dissectors themselves running atop IP, that they can fetch the source and destination IP addresses for the IP datagram that directly contained them). ------------------------------ ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
