Wireshark-dev: Re: [Wireshark-dev] Issue with tvbuff_t

Date: Thu, 17 Dec 2009 15:23:05 -0500
Not completely sure I understand your question #1, but here's what I usually do:

  a) starting with the original tvbuff_t* "tvb", I process my protocol's portion of the packet
  b) say my protocol uses N bytes, leaving R = (tvb_length(tvb) - N) bytes for the next dissector
  c) I create a new tvbuff_t*:  sub_tvb = tvb_new_subset( tvb, N, R, R)
  d) I pass sub_tvb to the next dissector

On question #2, I think any valid tvbuff_t* can be used for those calls.