Re: Encapsulated IP

[Stephen Fisher <steve () stephen-fisher com>]

On Mon, Sep 20, 2010 at 10:22:45AM -0700, Ronald Howe wrote:

> Hello I am new and have a question about the IP dissector. I have 
> written a plug-in for my work and one of the packets has encapsulated 
> IP. I call the IP dissector and that works fine my question is there 
> any way to call the dissector and not have it update the source and 
> destination fields? Can I lock those before I call the dissector?

This may work:

  col_set_writable(COL_DEF_SRC, FALSE);
  col_set_writable(COL_DEF_DST, FALSE);

Those are the two default source and address columns that Wireshark 
uses.  The user may have defined other source/destination columns (such 
as unresolved or custom columns) that this wouldn't affect.

You can also call col_get_writable(COL_xxx) (or use the macro 
COL_GET_WRITABLE directly) to check if a column is writable.  These 
functions are in epan/column-utils.h.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe