Wireshark mailing list archives

Re: Extracting field values in a C post-dissector


From: Guy Harris <guy () alum mit edu>
Date: Sun, 4 Sep 2016 19:59:17 -0700

On Aug 22, 2016, at 6:40 AM, Pascal Quantin <pascal.quantin () gmail com> wrote:

By having a quick look at the code, I *think* you will want first to retrieve the hfindex of a given field by using 
proto_registrar_get_id_byname(), then mark it as "interesting" with proto_tree_prime_hfid()

...which you have to do before the dissection starts.

Unfortunately, you can't do that in a post-dissector.

So...

aOr a cll to proto_find_finfo() should work also without the need to prime the field, but should be slower according 
to the comments in proto.h.

...you might have to do it that way, instead.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: