wireshark-dev August 2010 archive
Main Archive Page > Month Archives  > wireshark-dev archives
wireshark-dev: Re: [Wireshark-dev] Get data from previous reques

Re: [Wireshark-dev] Get data from previous request packet in subsequent reply packet

From: Frank Lahm <franklahm_at_nospam>
Date: Thu Aug 26 2010 - 14:51:21 GMT
To: Developer support list for Wireshark <wireshark-dev@wireshark.org>

Richard,

2010/8/26 Richard van der Hoff <rav@faith.sw1v.org>:
> On Thu, 26 Aug 2010, Frank Lahm wrote:
>
>> 2010/8/26 Frank Lahm <franklahm@googlemail.com>:
>>> Hi list,
>>>
>>> I'm trying to find a way to get at data from a previous request packet
>>> in order to correctly dissect the current packet.
>
> Frank,
>
> I only skimmed your code, so it may be that you have this covered already,
> but do remember that your dissector will not always be called with the
> packets in sequential order. (It will be called with each packet in turn
> initially, but will then be called again for each packet the user clicks
> on). So if there's more than one request in the conversation, you need to
> make sure that you are cross-referencing to the right one when dissecting
> responses.

thanks for chiming in!

As a long time user of the AFP dissector I know that it handles
multiple conversations right. ;)
It's just the first time that I start to make substantial enhancements
to the dissector. Alas, I picked a tough target for a starter: AFP is
completely documented by Apple besided one singel AFP call
FPSpotlightRPC. So I've got to reverse engineer it which turns out to
be a tough task ask the packets are complicated.

Cheers, Frank!
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@wireshark.org?subject=unsubscribe