This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I know that dissectors only work on the current packet, but is there a way to access previous or future frames from the current frame in a dissector? I am trying to display a calculated checksum in the initial frame after the whole fragmented message has been reassembled.

asked 08 Jun '17, 10:49

jpetersen's gravatar image

jpetersen
6335
accept rate: 0%

Shouldn't you be doing that in the last frame together with the Reassembled data?

(08 Jun '17, 11:55) Anders ♦

I would like to display it in the initial fragment as well because that has all of the other information from the message in it.

I want to display all the information with the validated checksum so either add the calculated checksum to a previous frame, or add all the information from the initial fragment to the future frame where the checksum is calculated.

(08 Jun '17, 13:04) jpetersen

Yes, this is possible taking into account how Wireshark is processing your capture file. First it reads it sequentially and then uses additional, random access reads to get details.

You can make use of that, eg. for request and response tracking. This is described in doc/README.request_response_tracking. You can track other stuff as well, eg. the data you seem to need.

Mind you this depends on 2-pass analysis of the capture file, so it using tshark you'll have to give the -2 option for it to work there.

permanent link

answered 08 Jun '17, 14:36

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thank you for your reply, I have been looking into request_response_tracking and it has been helpful.

(09 Jun '17, 08:47) jpetersen
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×78
×41
×36
×27

question asked: 08 Jun '17, 10:49

question was seen: 756 times

last updated: 09 Jun '17, 08:47

p​o​w​e​r​e​d by O​S​Q​A