Re: Encapsulated IP

[Ronald Howe <rhowe () apriva com>]

I understand that there is no guarantee. All I really want to do is change the display for source and destination not 
change anything to do with the packet. 
The packet is a UDP which gets haded to my dissector with some information from our protocol. I use that then 
tvb_new_subset and call_dissector to hand the encapsulated IP. 
before I call call_dissector the Displayed source and destination is correct. when it returns it is updated to the 
encapsulated source and destination but the whole packet is decoded at that point.
all I wanted to do was to change the display back to the original IP information. But if I understand you correctly 
this is not prudent because it will have unknown affects on the other packets? 

------------------------------

Message: 11
Date: Tue, 21 Sep 2010 11:24:00 -0700
From: Guy Harris <guy () alum mit edu>
Subject: Re: [Wireshark-dev] Encapsulated IP
To: Developer support list for Wireshark <wireshark-dev () wireshark org>
Message-ID: <598C2B55-7CED-47DD-8054-A82247E26275 () alum mit edu>
Content-Type: text/plain; charset=us-ascii


On Sep 21, 2010, at 9:51 AM, Ronald Howe wrote:

> ok Can I then use SET_ADDRESS to put the Source and Destination fields back to the original IP address not the 
> encapsulated Address?

We make no guarantee whatsoever that dissectors for protocols running atop the encapsulated IP will work correctly if 
they run with the original IP addresses rather than the encapsulated IP addresses as the source and destination 
network-layer addresses.  See my previous message.


------------------------------

_______________________________________________
Wireshark-dev mailing list
Wireshark-dev () wireshark org
https://wireshark.org/mailman/listinfo/wireshark-dev


End of Wireshark-dev Digest, Vol 52, Issue 31
*********************************************
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe