Re: Dissector for stream data

[Andreas <AndreasSander1 () gmx net>]

Am 24.12.2011 14:16, schrieb Andriy Beregovenko:
> If I open dump, select frame, and push 'END' I move to end of dump.
> At this time all frames between first few frames and few last frames, not
> decoded, so I can't correct decode last frame.
> Question is: how I can walk through all frames that will be passed to
> dissector if we look frames one-by-one?
Wireshark passes all packets in order to the dissector, when the capture 
is loaded. After this the dissector will get the packets in arbitrary 
order.

The dissector can distinguish between both calls (see PINFO_FD_VISITED 
macro) and build conversation information in the first phase.

Andy

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe