This is our old Q&A Site. Please post any new questions and answers at

I'm extending the radiotap dissector to calculate the inter frame space since the previous frame, so I need to reference the previous frame in the dissector. What is the correct way to do this? I'm currently using a global reference to cfile, and call to frame_data_sequence_find, but this global reference is a problem at link time.

asked 21 Nov '12, 15:01

protocolmagic's gravatar image

accept rate: 0%

You should probably set up a conversation saving information in the conversation data use that data in the next frame to do the calculation save the result in per packet data, store the new base in conersation data etc. Guarding it with pinfo->visited to only do the calculation on the first pass and use the per packet data when displaying the result.

permanent link

answered 22 Nov '12, 07:24

Anders's gravatar image

Anders ♦
accept rate: 17%

Correct. Wireshark isn't set up to have dissectors look at any frame other than the current frame; the correct way to process information in earlier frames is to save it in a data structure for future reference.

(22 Nov '12, 10:11) Guy Harris ♦♦

I think I found the correct way to do this. Before wireshark makes an initial pass through all the frames in a capture it calls your dissector's 'init' routine, if you register one. Here you can reset your state, and maintain it. Next when the dissect routine is called if the fd->flags->visited is not set then the frame is the next one to be dissected. If the visited flag is set this may be a random access and sould be ignored. So I create a static 'last frame' variable, reset it in 'init', update it every time the dissector is called with a unvisited frame. Next i add local frame data to the unvisited frame, and put what i need in there (reference to previous frame).

permanent link

answered 22 Nov '12, 18:43

protocolmagic's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 21 Nov '12, 15:01

question was seen: 4,660 times

last updated: 22 Nov '12, 18:43

p​o​w​e​r​e​d by O​S​Q​A