This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can I change data in other frames from the current frame in a dissector?

0

I know that dissectors only work on the current packet, but is there a way to access previous or future frames from the current frame in a dissector? I am trying to display a calculated checksum in the initial frame after the whole fragmented message has been reassembled.

asked 08 Jun '17, 10:49

jpetersen's gravatar image

jpetersen
6335
accept rate: 0%

Shouldn't you be doing that in the last frame together with the Reassembled data?

(08 Jun '17, 11:55) Anders ♦

I would like to display it in the initial fragment as well because that has all of the other information from the message in it.

I want to display all the information with the validated checksum so either add the calculated checksum to a previous frame, or add all the information from the initial fragment to the future frame where the checksum is calculated.

(08 Jun '17, 13:04) jpetersen

One Answer:

0

Yes, this is possible taking into account how Wireshark is processing your capture file. First it reads it sequentially and then uses additional, random access reads to get details.

You can make use of that, eg. for request and response tracking. This is described in doc/README.request_response_tracking. You can track other stuff as well, eg. the data you seem to need.

Mind you this depends on 2-pass analysis of the capture file, so it using tshark you'll have to give the -2 option for it to work there.

answered 08 Jun '17, 14:36

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thank you for your reply, I have been looking into request_response_tracking and it has been helpful.

(09 Jun '17, 08:47) jpetersen