I am trying to create a dissector for packets which use the TIPC encoding. The dissector will convert the destination port into a meaningful value by comparing against a table as well as doing some analysis on the data. This information would be presented as well as all the TIPC information. I currently have it so "dissect_mydissect(tvbuff_t tvb, packet_info pinfo, proto_tree *tree)" is called for the correct packets, but the data being passed to it in tvb is only the data inside the TIPC packet not the information I need. I see its possible to get the Ethernet and frame data for a packet but is it possible to get the TIPC (or any encapsulating value for that matter) or would I need to create my own TIPC dissector and add my functionality to that.
Thanks for your time,
asked 31 Jul '12, 00:51
If a dissector needs/want information from the encapsulating layer, then that dissector must make that data available somehow and pass it down. That is what packet_info is for. If you have control over both dissectors, you could pass info via a structure in packet_info.private_data.
answered 31 Jul '12, 14:26