On Mon, Sep 20, 2010 at 10:22:45AM -0700, Ronald Howe wrote:
> Hello I am new and have a question about the IP dissector. I have
> written a plug-in for my work and one of the packets has encapsulated
> IP. I call the IP dissector and that works fine my question is there
> any way to call the dissector and not have it update the source and
> destination fields? Can I lock those before I call the dissector?
This may work:
col_set_writable(COL_DEF_SRC, FALSE);
col_set_writable(COL_DEF_DST, FALSE);
Those are the two default source and address columns that Wireshark
uses. The user may have defined other source/destination columns (such
as unresolved or custom columns) that this wouldn't affect.
You can also call col_get_writable(COL_xxx) (or use the macro
COL_GET_WRITABLE directly) to check if a column is writable. These
functions are in epan/column-utils.h.