Wireshark-dev: Re: [Wireshark-dev] Dissector for stream data

From: Andreas <AndreasSander1@xxxxxxx>
Date: Sun, 25 Dec 2011 06:35:42 +0100
Am 24.12.2011 14:16, schrieb Andriy Beregovenko:
If I open dump, select frame, and push 'END' I move to end of dump.
At this time all frames between first few frames and few last frames, not
decoded, so I can't correct decode last frame.
Question is: how I can walk through all frames that will be passed to
dissector if we look frames one-by-one?
Wireshark passes all packets in order to the dissector, when the capture is loaded. After this the dissector will get the packets in arbitrary order.

The dissector can distinguish between both calls (see PINFO_FD_VISITED macro) and build conversation information in the first phase.

Andy