Wireshark-dev: Re: [Wireshark-dev] Peek at HTTP Headers as Subdissector

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 28 Jul 2008 10:36:35 -0700

On Jul 28, 2008, at 5:59 AM, DeRosa, Anthony wrote:

I'm writing an HTTP subdissector. Given that the tvbuff_t passed to an
HTTP subdissector is a subset of the tvbuff_t that contains the HTTP
headers, is there any way to peek at the HTTP headers? In other words,
is there a way to peek at the parent tvbuff_t, when all you have is a
subset?

No, there isn't.

What information do you need from the HTTP headers?