This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Best practice for stateful packet dissection

0

Hi, I have a protocol where the dissection of a current frame depends on information provided in a previous (header) packet.

What is the common way to implement such a behaviour in the dissector? I.e. how to deal with transfering state information from one packet to a subsequent packet in the first run? From my point of view I would only need to store the protocol state in a global (maybe wmem-allocated) variable and update upon reception of a new state-changing (header) packet.. Any hints for me?

asked 17 Nov '14, 16:27

Enrico's gravatar image

Enrico
11112
accept rate: 0%