From: Diwakar Shetty [mailto:diwakar@xxxxxxxxxxxxxx]
Sent: Wednesday, February 28, 2001 9:32 PM
> 1) What all things do I have to do for creating a new "tvbuff_t *tvb".
>
> Can I just use the function "tvb_new_real_data()" passing the
> pointer to the uncompressed data in the first arguement like in
> "packet.c".
Yes, that is all you have to do. Just remember to free the tvbuff,
with tvb_free_chain, after calling the sub-dissector.
> 2) What about the old "tvbuff". Who will release the memory used by
> that? Do I have to ? Which function to use for releasing?
Ignore that. It will happen in the code that calls your dissector.
>3) How do I initialise the second arguement "packet_info *pinfo".
Why do you want to do this?
> The reason I am asking is because in our project the PPP packets are
> not only compressed but also are spilt into more than one packets. Hence
> it is NOT that for every packet we receive we call "dissect_ppp". Rather
> after receiving "many" spilt compressed PPP packets, we REASSEMBLE,
> UNCOMPRESS and then pass it on to "dissect_ppp".
I have seen most of these problems in the dissector I'm working on. It
is sliding window decompression, so I have to keep track of historical
data, and generate the uncompress packet to pass to sub-dissectors.
Here's what I did to solve my problems. I create a conversation for
both sides of the data stream (frame relay based in my case), in this
conversation structure I store a pointer to the historical data buffer.
When I have a data packet that has to be decompress, I run the
decompression routine to create the raw data, create the new tvbuff and
pass that to the sub-dissector. I also save the raw data in a proto base
packet data attachment, checkout p_set_proto_data and p_get_proto_data.
When the user select the packet in the GUI I pass the saved raw data
to the sub-dissector. You can use the pinfo->fd->flags.visited value
to determine if this is the first pass or a user selection.
The current problem I'm working on is how to display this "reconstructed"
data. More on that later.
Jeff Foster
jfoste@xxxxxxxxxxxx