Hi! What I wonder is, how can you make so that your dissector compares the next packet to the previous one? I want to make so that if the next packet has the same data as the previous one, it wont be displayed. I dont want to show a large amount of packtes in a row that are identical, I only want to show packets where some change has been made to the data. Anyone knows? Cheers / Martino asked 09 Apr '12, 01:09  Martino |
One Answer:
You can't make a dissector decide whether a frame will be displayed or not, that is only possible through display filters. But you can make them work together. For example, if you create a field in your dissector that is only present if the packet is different from the previous packet in the same conversation, then you can filter in that field with a display filter. For this to work, you need to work with "conversations" and "per-packet" data. See paragraph 2.2.1 and 2.5 in "doc/README.developer" answered 09 Apr '12, 02:02  SYN-bit ♦♦ |
