Ask Your Question

Revision history [back]

Access lower layer protocol information from dissector

Hi,

I'm sure it's a question that has been asked many times, but I could not find it... In the C dissector I'm writing on top of UDP (triggered by udp.port), I need to access the 'total length' field from the UDP header. I need this because captured packet length is not enough as there can be Ethernet padding.

But when the dissector gets called, I can only access payload, not header from lower layer protocol. I guess I'll have to mess around with packet_info and/or proto_tree but I did not figure it out.

Thanks in advance!

Access lower layer protocol information from dissector

Hi,

I'm sure it's a question that has been asked many times, but I could not find it... In the C dissector I'm writing on top of UDP (triggered by udp.port), I need to access the 'total length' field from the UDP header. I need this because captured packet length is not enough as there can be Ethernet padding.

But when the dissector gets called, I can only access payload, not header from lower layer protocol. I guess I'll have to mess around with packet_info and/or or proto_tree but I did not figure it out.

Thanks in advance!

Access lower layer protocol information from dissector

Hi,

I'm sure it's a question that has been asked many times, but I could not find it... In the C dissector I'm writing on top of UDP (triggered by udp.port), I need to access the 'total length' field from the UDP header. I need this because captured packet length is not enough as there can be Ethernet padding.

But when the dissector gets called, I can only access payload, not header from lower layer protocol. I guess I'll have to mess around with packet_info or proto_tree but I did not figure it out.

Thanks in advance!

click to hide/show revision 4
None

Access lower layer protocol information from dissector

Hi,

I'm sure it's a question that has been asked many times, but I could not find it... In the C dissector I'm writing on top of UDP (triggered by udp.port), I need to access the 'total length' field from the UDP header. I need this because captured packet length is not enough as there can be Ethernet padding.

But when the dissector gets called, I can only access payload, not header from lower layer protocol. I guess I'll have to mess around with packet_info or proto_tree but I did not figure it out.

Thanks in advance!