This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Data Parameter and Private_Data

0

I'm trying not to avoid the pinfo -> private_data as I want to use the data parameter. My questions is which function definition do I change to be able to use the data parameter, in my dissector there is no function that takes a 4th parameter!

if (handle->is_new) {
        ret = (*handle->dissector.new_d)(tvb, pinfo, tree, data);
    } else {
        pinfo->private_data = data;     // ADDED!!!!!!!!!!!!!!!!!!!!
        (*handle->dissector.old)(tvb, pinfo, tree);
        ret = tvb_length(tvb);
        if (ret == 0) {
            ret = 1;
        }
    }

Could you please explain exactly what happens here:

ret = (*handle->dissector.new_d)(tvb, pinfo, tree, data);

and here

(*handle->dissector.old)(tvb, pinfo, tree);

In my case I have the following:

X_handle = new_create_dissector_handle(dissect_X, proto_X);
arr_handle = create_dissector_handle(dissect_arr, proto_ZZX);
arr_handle = create_dissector_handle(dissect_arr, proto_XXZ);

heur_dissector_add("udp", dissect_X, proto_X); dissector_add_uint("tcp.port", ZZX_PORT, arr_handle); dissector_add_uint("tcp.port", XXZ_PORT, arr_handle);

Function call leading upto where pinfo->private_data is used: dissect_X -> dissect_arr_X -> dissect_retransmissions_X -> add_seq dissect_arr -> dissect_retransmissions -> add_seq

static gboolean add_seq(tvbuff_t *tvb, packet_info *pinfo)

asked 13 May ‘15, 13:25

XQW1123's gravatar image

XQW1123
4681014
accept rate: 0%

edited 13 May ‘15, 13:59


One Answer:

1

in my dissector there is no function that takes a 4th parameter!

Then change the dissector so that its main function does take a 4th parameter, which will be a void * pointing to the data passed to it.

Note that, in the currently-supported versions of Wireshark (1.10.x, 1.12.x, and 1.99.x), if the function dissect_X() does not have 4 parameters:

int dissect_X(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
{
    ...
}

then the call to new_create_dissector_handle() in

X_handle = new_create_dissector_handle(dissect_X, proto_X);

will get a warning. DO NOT IGNORE THIS WARNING! Instead, fix dissect_X() to take that fourth parameter.

answered 13 May '15, 14:06

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%