 | 1 | initial version |
The dissector code has no access to pinfo of any other packet than the one currently dissected.
If some transaction ID exists in modbus which allows you to match requests and responses, you may use two tables indexed by this transaction ID and store the frame.number of the currently dissected packet to the appropriate table (request{transactionId} or response{transactionId}) during the first pass of the dissector (after loading the file, all packets are dissected in sequence). Whenever you click a packet in the packet list, it is dissected again so that the dissectoon tree could be displayed in the dissection pane; whenever you change the display filter, the packets are dissected in sequence again to be able to match the dissected fields to the filter conditions.
So while dissecting a response, you may check whether a matching request exists in the capture by looking to request{transactionId}, and vice versa.
Have a look here to see how to render that information into the dissection tree nicely.
| | 2 | No.2 Revision |
The dissector code has no access to pinfo of any other packet than the one currently dissected.
If some transaction ID exists in modbus which allows you to match requests and responses, you may use two global tables indexed by this transaction ID and store the frame.number of the currently dissected packet to the appropriate table (request{transactionId} or response{transactionId}) during the first pass of the dissector (after loading the file, all packets are dissected in sequence). Whenever you click a packet in the packet list, it is dissected again so that the dissectoon tree could be displayed in the dissection pane; whenever you change the display filter, the packets are dissected in sequence again to be able to match the dissected fields to the filter conditions.
So while dissecting a response, you may check whether a matching request exists in the capture by looking to request{transactionId}, and vice versa.
Have a look here to see how to render that information into the dissection tree nicely.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
