This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to obtain informations from a dissector inside a sub-dissector ?

I'm writting a dissector for the modludp64 protocol. It's work, this is cool and I release it in few days. But before I want to add some features. To distinguish messages, I need to know if the destination ip address is unicast or multicast, but I don't know how to retreive this informations.

Someone can help me.

development dissector sub-dissector

asked 20 Mar '11, 14:15

chronidev
11●5●5●7
accept rate: 0%

One Answer:

This should result in TRUE for multicast addresses (untested YMMV).

((pinfo->net_dst.type == AT_IPv4) && (((*(guint8 *)(pinfo->net_dst.data) & 0xF0) == 0xE0)) || ((pinfo->net_dst.type == AT_IPv6) && ((*(guint8 *)(pinfo->net_dst.data) == 0xFF))))

answered 21 Mar '11, 06:11

Jaap ♦
11.7k●16●101
accept rate: 14%