How does Wireshark store all the addresses of a deep tunnel?

Question

Good day everyone.

Currently I'm interested in tunneling. For example I have a tunnel with the following protocols stack: alt text

And my question is how does wireshrk store all the addresses for each packet (in my example there are three IPv4-addresses)? I thought of packet_info structure, but there are only two fields:

address net_src;                  /**< network-layer source address */
address src;                      /**< source address (net if present, DL otherwise )*/

Thanks in advance.

Accepted Answer

Wireshark will keep the outermost IP addresses in the packet_info struct, as there are the real addresses for the particular packet at the network layer. These addresses are used in the source and destination column.

However, for each IP address encountered in an IP header, it will add a ip.src or ip.dst field to the dissection tree (as well as an ip.addr for both of them). So when using the display filter ip.src==10.0.0.1, it will be interpreted as "Display all packets for which there is at least one field with the name ip.src that has the value 10.0.0.1".