On 11/22/2011 7:02 PM, Bill Meier wrote:
So, it may be the case that you'll need to store "per-frame" info about any decisions made as to how to dissect a particular packet based upon a previous packet. When an arbitrary packet is then dissected again later the associated per-packet info is used to do the dissection in the same way as done during the first sequential pass.
Or: If the nature of the state info is akin to "setup" info which once seen applies to all the following packets of a conversation then use of a conversation should be sufficient.
(Of course your dissector will need to handle the case wherein a capture "starts in the middle" such that info from a previous packet is not available).
If the state info can be different for each of the streams then you may want to use a GHashtable associated with a conversation to store info for each individual stream associated with a conversation (connection).
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
