2019-12-03 14:43:13 +0000 received badge ● Popular Question (source) 2019-03-11 13:23:38 +0000 received badge ● Famous Question (source) 2018-11-15 08:41:50 +0000 received badge ● Notable Question (source) 2018-10-02 15:09:04 +0000 received badge ● Famous Question (source) 2018-07-12 09:47:35 +0000 received badge ● Notable Question (source) 2018-06-28 09:47:37 +0000 received badge ● Popular Question (source) 2018-05-20 11:10:17 +0000 received badge ● Popular Question (source) 2018-03-25 21:30:48 +0000 received badge ● Notable Question (source) 2018-02-28 02:11:54 +0000 received badge ● Popular Question (source) 2017-12-18 14:10:31 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets? Thank you. 2017-12-18 14:10:18 +0000 marked best answer How do I dissect packets if the dissection depends on information from earlier packets? For example, as shown in the image below, if I have two UDP packets in different frames, frames 39 and 40, how would I go about dissecting them together? I need data from both packets. I assume I can't use reassembly, since reassembly is for split packets. Would I need to use more then one dissector? 2017-12-15 19:27:21 +0000 commented answer Is it possible to use reassembly on non-split packets? Yes, frames 39 to 44 each have MASP packets in them, and I would like to dissect 39 and 40, because only together can I 2017-12-15 19:16:22 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets? Apologies! I changed the image if that helps. At the moment, my protocol just simply takes in all packets from UDP port 2017-12-15 19:14:34 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets? Apologies! I changed the image if that helps. My protocol just simply takes in all packets from UDP port 10160, and chan 2017-12-15 19:12:14 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets? Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac 2017-12-15 19:06:12 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets? Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac 2017-12-15 18:36:25 +0000 commented answer Is it possible to use reassembly on non-split packets? Multiple complete packets, which I don't know how to dissect in a single dissector. 2017-12-15 18:23:39 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets? Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac 2017-12-15 18:22:42 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets? Oh no that's not it, I just set the text in the column to say "Message fragment" (for no reason really), these aren't ac 2017-12-15 18:22:25 +0000 commented answer How do I dissect packets if the dissection depends on information from earlier packets? Oh no that's not it, I just set the text in the column to say "Message fragment" (for no reason really), these aren't ac 2017-12-15 14:55:47 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets? Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac 2017-12-15 14:54:43 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets? Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac 2017-12-15 14:53:08 +0000 edited question How do I dissect packets if the dissection depends on information from earlier packets? Can I dissect multiple packets without using reassembly? For example, as shown in the image below, if I have two UDP pac 2017-12-15 14:46:30 +0000 asked a question How do I dissect packets if the dissection depends on information from earlier packets? Can I dissect multiple packets without using reassembly? For example, if I have two UDP packets (they are not split, and 2017-12-15 14:33:52 +0000 received badge ● Commentator 2017-12-15 14:33:52 +0000 commented question Is it possible to use reassembly on non-split packets? I see, then how would I go about dissecting multiple packets in one dissector? Surely there must be a way to do this. 2017-12-15 14:31:38 +0000 commented answer Is it possible to use reassembly on non-split packets? No, I'm not talking about multiple fragments in a single packet, I'm talking about entirely separate packets. 2017-12-14 19:37:47 +0000 commented question Is it possible to use reassembly on non-split packets? It's for a project, if it isn't possible to apply reassembly to packets that aren't split, then is there another way to 2017-12-14 16:46:01 +0000 commented question Is it possible to use reassembly on non-split packets? These packets are running over UDP. I'm still fairly new to wireshark, so I'm still not familiar with some terms, like " 2017-12-14 16:44:33 +0000 commented question Is it possible to use reassembly on non-split packets? These packets are running over UDP. I'm still fairly new to wireshark, so I'm still not familiar with some terms, like " 2017-12-14 16:14:04 +0000 received badge ● Organizer (source) 2017-12-14 16:06:57 +0000 asked a question Is it possible to use reassembly on non-split packets? Is it possible to use reassembly on non-split packets? I need to dissect multiple packets, but they are not necessarily 2017-12-14 15:25:16 +0000 asked a question How do I use the fragment_add_seq_check function in UDP packet reassembly? How do I use the fragment_add_seq_check function in UDP packet reassembly? I'm writing a dissector which dissects multip 2017-12-05 16:46:09 +0000 commented answer How do I dissect multiple packets? 2.7 seems to be only for TCP, is there instructions for reassembly for UDP? 2017-12-05 15:10:41 +0000 asked a question How do I dissect multiple packets? How do I dissect multiple packets? For example, if there is information I can obtain only by using data from 2 packets ( 2017-11-03 18:42:59 +0000 commented answer How do I add "child item" to an item in the subtree? One more thing, how do I add text as an item? 2017-11-03 18:33:53 +0000 commented answer How do I add "child item" to an item in the subtree? Thank you. 2017-11-03 18:33:02 +0000 marked best answer How do I add "child item" to an item in the subtree? For example, if I have the item: VarData: Active (0x90) How do I add details under this item? I would like to add some text under it. I use C to make my dissector. 2017-11-03 16:19:38 +0000 edited question How do I add "child item" to an item in the subtree? How do I add "child item" to an item in the subtree? For example, if I have the item: VarData: Active (0x90) How d 2017-11-03 16:10:08 +0000 marked best answer How do I get and display packet data information at a specific byte from the first byte? Hello, I am a beginner in Wireshark and dissector building, right now I'm just trying to figure out how to fetch and display packet data. I use the following lines in my dissect function: guint val; val = tvb_get_guint8(tvb, 1); proto_tree_add_uint(masp_tree, hf_masp_data, tvb, 1, 1, val);  Here is an image of the results: Expected result: 0x00 Actual result: 0x60 Why does fetching the data start from the 43rd byte instead of the very 1st one? How do I resolve this issue? Thanks 2017-11-03 16:10:08 +0000 received badge ● Scholar (source) 2017-11-03 16:03:14 +0000 asked a question How do I add "child item" to an item in the subtree? How do I add "child item" to an item in the subtree? For example, if I have the item: VarData: Active (0x90) How d 2017-11-02 14:53:18 +0000 commented answer How do I get and display packet data information at a specific byte from the first byte? I need only the byte 2017-11-01 15:36:12 +0000 commented answer How do I get and display packet data information at a specific byte from the first byte? It's for a project. Is there a way to access the top tvb corresponding to the Ethernet frame?