Eloy Paris wrote:
For each layer (protocol) in a packet I need to obtain the offset into
the packet. For example, for "eth:ip:icmp:data", the offsets would be:
eth: 0
ip: 14 (IP with no options)
icmp: 34 (ICMP echo request)
data: 42
I have been using the value of the "start" field of "struct field_info"
(epan/proto.h). However, I just found out that in some cases "start" can
be zero.
"Some cases" includes any case where you have reassembly - whether
IPv4/v6 fragmentation reassembly, reassembly of packet chunks in a TCP
stream, etc..
It also includes cases where you have compressed packet data that's
decompressed before dissection (in which case it's not clear what the
offset would mean) or encrypted packet data that's decrypted before
dissection.
I.e., the general problem is insoluble. What is it you're trying to do?