wireshark-dev November 2010 archive
Main Archive Page > Month Archives  > wireshark-dev archives
wireshark-dev: Re: [Wireshark-dev] Filter for generated items

Re: [Wireshark-dev] Filter for generated items

From: Helge Kruse <Helge.Kruse-nospam_at_nospam>
Date: Thu Nov 18 2010 - 17:16:52 GMT
To: wireshark-dev@wireshark.org

Am 16.11.2010 21:45, schrieb Stephen Fisher:
> On Tue, Nov 16, 2010 at 09:13:57PM +0100, Helge Kruse wrote:
>> But I cannot convince anybody to update there 1.2.x installations to
>> 1.4.x.
>> So I must now decide if I have to provide a DLL compile with the 1.2.x
>> header and libs and an additional DLL compiled with the 1.4.x header
>> and libs. I don't think about the development branches (1.3.x).
> Yes, then making DLL of your plugin for version 1.2.x and 1.4.x would be
> the way to go.

I doubt that this is true. I started to compare these versions and found
some differences. At least two seam to be important.

1) The new libWireshark.DLL does not export all functions that had been
exported by the version 1.2.3. Well, most of these functions are for
internal Wireshark use only. But what, if my dissector calls

2) There are some structures that have been changed. There may be also
some Wireshark-internal-only structures. But Wireshark passes a pointer
to the packet_info to each dissector. The packet_info member fd points
to the frame_data structure. This structure layout has changed,it's just
incompatible. I checked this by running 1.4.1 in the debugger; the
timestamps are different.

Fortunately my dissector needs only the ordinal number of the frame in
the capture what can be found in front of the change. So it works -- by

Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev