Re: [Wireshark-dev] Dissector for stream data

2011-12-25 Thread Andriy Beregovenko
Hi Guy, On Sun, Dec 25, 2011 at 01:06:27PM -0800, Guy Harris wrote: > > On Dec 25, 2011, at 12:45 PM, Guy Harris wrote: > > > What Wireshark does *NOT* do is pass a non-null protocol tree pointer to > > the dissector when loading a capture file; > > Or, more correctly, what Wireshark does *NOT

Re: [Wireshark-dev] Dissector for stream data

2011-12-25 Thread Guy Harris
On Dec 25, 2011, at 12:45 PM, Guy Harris wrote: > What Wireshark does *NOT* do is pass a non-null protocol tree pointer to the > dissector when loading a capture file; Or, more correctly, what Wireshark does *NOT* do is *guarantee* that the protocol tree pointer passed to the dissector when lo

Re: [Wireshark-dev] Dissector for stream data

2011-12-25 Thread Guy Harris
On Dec 25, 2011, at 1:50 AM, Andriy Beregovenko wrote: > Hi Andreas, > > On Sun, Dec 25, 2011 at 06:35:42AM +0100, Andreas wrote: >> >> Wireshark passes all packets in order to the dissector, when the >> capture is loaded. After this the dissector will get the packets in >> arbitrary order. >

Re: [Wireshark-dev] Dissector for stream data

2011-12-25 Thread Andriy Beregovenko
Hi Andreas, On Sun, Dec 25, 2011 at 06:35:42AM +0100, Andreas wrote: > Am 24.12.2011 14:16, schrieb Andriy Beregovenko: > >If I open dump, select frame, and push 'END' I move to end of dump. > >At this time all frames between first few frames and few last frames, not > >decoded, so I can't correct

Re: [Wireshark-dev] Dissector for stream data

2011-12-24 Thread Andreas
Am 24.12.2011 14:16, schrieb Andriy Beregovenko: If I open dump, select frame, and push 'END' I move to end of dump. At this time all frames between first few frames and few last frames, not decoded, so I can't correct decode last frame. Question is: how I can walk through all frames that will be

Re: [Wireshark-dev] Dissector for stream data

2011-12-24 Thread Andriy Beregovenko
Hi, Also I got another problem: If I open dump, select frame, and push 'END' I move to end of dump. At this time all frames between first few frames and few last frames, not decoded, so I can't correct decode last frame. Question is: how I can walk through all frames that will be passed to dissect

Re: [Wireshark-dev] Dissector for stream data

2011-12-19 Thread Andriy Beregovenko
Hi Jaap, On Mon, Dec 19, 2011 at 03:42:05PM +0100, Jaap Keuter wrote: > On 2011-12-18 14:17, Andriy Beregovenko wrote: > > >Hi, > > > >Now i'm writing dissector for some kind of traffic. I'm already > >got basic > >knowledge in dissector writing, so first primitive version was > >already done. >

Re: [Wireshark-dev] Dissector for stream data

2011-12-19 Thread Jaap Keuter
On 2011-12-18 14:17, Andriy Beregovenko wrote: Hi, Now i'm writing dissector for some kind of traffic. I'm already got basic knowledge in dissector writing, so first primitive version was already done. But now, when I try to complete fully featured version of dissector I got many trobles wit

[Wireshark-dev] Dissector for stream data

2011-12-18 Thread Andriy Beregovenko
Hi, Now i'm writing dissector for some kind of traffic. I'm already got basic knowledge in dissector writing, so first primitive version was already done. But now, when I try to complete fully featured version of dissector I got many trobles with routine. So I'm looking for good advice from experi