I understand that there is no guarantee. All I really want to do is change the display for source and destination not change anything to do with the packet.
The packet is a UDP which gets haded to my dissector with some information from our protocol. I use that then tvb_new_subset and call_dissector to hand the encapsulated IP.
before I call call_dissector the Displayed source and destination is correct. when it returns it is updated to the encapsulated source and destination but the whole packet is decoded at that point.
all I wanted to do was to change the display back to the original IP information. But if I understand you correctly this is not prudent because it will have unknown affects on the other packets?
------------------------------
Message: 11
Date: Tue, 21 Sep 2010 11:24:00 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Encapsulated IP
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Message-ID: <598C2B55-7CED-47DD-8054-A82247E26275@xxxxxxxxxxxx>
Content-Type: text/plain; charset=us-ascii
On Sep 21, 2010, at 9:51 AM, Ronald Howe wrote:
> ok Can I then use SET_ADDRESS to put the Source and Destination fields back to the original IP address not the encapsulated Address?
We make no guarantee whatsoever that dissectors for protocols running atop the encapsulated IP will work correctly if they run with the original IP addresses rather than the encapsulated IP addresses as the source and destination network-layer addresses. See my previous message.
------------------------------
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-dev
End of Wireshark-dev Digest, Vol 52, Issue 31
*********************************************