If I have the number of a frame, is it possible to then look up the actual frame/packet?
I'm trying to make some enhancements to io_stat.c, and I'd like to show some information about the packet inside the graph window itself, when clicked on. The only context I have in that situation is the frame number.
asked 02 Jul '11, 01:10
retagged 02 Jul '11, 02:00
In 1.6 and later:
will get you the frame_data structure for the frame with the specified frame number. Whether that gives you all the information you need is another matter (and the frame_data structure will probably get things removed from it over time, to save memory - there's one of them for every packet in a capture).
The packet_info structure is another matter. That is generated when the packet is dissected, and is not saved (saving it would make Wireshark's memory usage even worse).
answered 02 Jul '11, 11:40
Guy Harris ♦♦
edited 02 Jul '11, 11:41