[Patrick Fuchs <rotfuchs@xxxxxxxxxxxxxxxxxxxxx>]

Guy Harris schrieb:
> rotfuchs@xxxxxxxxxxxxxxxxxxxxx wrote:
>
>   
> > is it possible to access data from a previous
> > per_packet_data_structure? I tried it with      "prev_frame_data =
> > p_get_proto_data(pinfo->fd->prev, proto_iec);"
> >
> > Should this work
> >     
>
> I'd expect it to work *IF*
>
>     1) there *is* a previous frame (i.e., pinfo->fd->prev is not null)
>
> and
>
>     2) that frame has a per-packet data structure for the IEC protocol
> associated with it.
>
> Note that pinfo->fd->prev refers to the previous packet in the capture,
> not the previous packet with a proto_iec item in it.
>   
Ok, i see the problem!

>   
> > or am i barking up the wrong tree?
> >     
>
> You might be - you might, for example, want to do whatever you're doing
> with a per-conversation data structure plus per-packet data structures. 
> What is it you're trying to do?
>   
I want to compare some data from the actual packet with data from the 
previous packet.I built up a convesation and i could implement a 
structure with two variables e.g. data and prev_data and copying the 
data to prev_data in every new packet.
But is there also a possibilty to access per-packet-data from the 
previous packet in the conversation, or rather store per-packet-data for 
a conversation?

Thank you, for your help.