I know that dissectors only work on the current packet, but is there a way to access previous or future frames from the current frame in a dissector? I am trying to display a calculated checksum in the initial frame after the whole fragmented message has been reassembled.
asked 08 Jun '17, 10:49
Yes, this is possible taking into account how Wireshark is processing your capture file. First it reads it sequentially and then uses additional, random access reads to get details.
You can make use of that, eg. for request and response tracking. This is described in
Mind you this depends on 2-pass analysis of the capture file, so it using tshark you'll have to give the
answered 08 Jun '17, 14:36