Hello,
I wrote a dissector in C language that works well. Now, I would like to use a post-dissector to regroup the lines that are displayed in the main Wireshark display, because there are multiple forwardings of the same packet.
I don't want to assemble a packet that was disassembled during transmission, I want to show several "equal" packets on the same line of the main display (I would like to build a tree on this line so you can see how many of the same packets were received) in order to reduce the visual pollution caused by dissecting the packets that are forwarded.
I read that post-dissectors are mainly used to record conversations, but they do not manipulate the lines of conversation they work on.
Is it possible to implement this idea of regrouping lines in the main display after passing through the dissector?
Thanks in advance,
Anderson