ok Can I then use SET_ADDRESS to put the Source and Destination fields back to the original IP address not the encapsulated Address?
That would be more useful to the guys using the tool.
thanks
Ron
________________________________________
ge: 5
Date: Mon, 20 Sep 2010 17:16:39 -0700
From: Ronald Howe <rhowe@xxxxxxxxxx>
Subject: Re: [Wireshark-dev] Encapsulated IP
To: "wireshark-dev@xxxxxxxxxxxxx" <wireshark-dev@xxxxxxxxxxxxx>
Message-ID:
<B096CFD34CBCD749BC0ECE00CD248732167F89727A@xxxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="us-ascii"
The col_set_writable does not seem to make a difference in the source and destination address
They seem to update when I call the ip dissector again. If I could read those columns before
I call the dissector I could replace the fields when it returns but I don't see a function in column-utils.h to do that.
------------------------------
Message: 6
Date: Mon, 20 Sep 2010 17:25:26 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Encapsulated IP
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Message-ID: <AD59B040-66AF-4B08-BDD9-E0B79E01786C@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 20, 2010, at 5:16 PM, Ronald Howe wrote:
> The col_set_writable does not seem to make a difference in the source and destination address
Nope. The columns are set based on the addresses set by SET_ADDRESS, and we do not allow a dissector to prevent another dissector from setting the address (if your dissector were to prevent the IP dissector from setting the address, that would violate assumptions, made by dissectors running atop IP and atop dissectors themselves running atop IP, that they can fetch the source and destination IP addresses for the IP datagram that directly contained them).
------------------------------