I'm extending the radiotap dissector to calculate the inter frame space since the previous frame, so I need to reference the previous frame in the dissector. What is the correct way to do this? I'm currently using a global reference to cfile, and call to frame_data_sequence_find, but this global reference is a problem at link time. asked 21 Nov '12, 15:01  protocolmagic |
2 Answers:
You should probably set up a conversation saving information in the conversation data use that data in the next frame to do the calculation save the result in per packet data, store the new base in conersation data etc. Guarding it with pinfo->visited to only do the calculation on the first pass and use the per packet data when displaying the result. answered 22 Nov '12, 07:24  Anders ♦ |
I think I found the correct way to do this. Before wireshark makes an initial pass through all the frames in a capture it calls your dissector's 'init' routine, if you register one. Here you can reset your state, and maintain it. Next when the dissect routine is called if the fd->flags->visited is not set then the frame is the next one to be dissected. If the visited flag is set this may be a random access and sould be ignored. So I create a static 'last frame' variable, reset it in 'init', update it every time the dissector is called with a unvisited frame. Next i add local frame data to the unvisited frame, and put what i need in there (reference to previous frame). answered 22 Nov '12, 18:43 protocolmagic |
Correct. Wireshark isn't set up to have dissectors look at any frame other than the current frame; the correct way to process information in earlier frames is to save it in a data structure for future reference.