Wireshark Generic Dissector

internal_frame

If you append some data into internal_frame, this data will be used for the following fields.
As when a decoder append more data than asked.

save_position, goto_position and move_position_... do not work with internal_frame


Example :

  # ...
  hide var uint8  varbyte1 = 234;
  call frame_append_data (internal_frame, varbyte1);
  
  uint8  byte1;            # byte1 contains 234
                           # nothing has been read from real data
  # ...


Example :

  # ...
  hide var uint8  varbyte1 = 0x34;
  call frame_append_data (internal_frame, varbyte1);
  hide var uint8  varbyte2 = 0xd5;
  call frame_append_data (internal_frame, varbyte2);
  
  uint16  bytes;           # bytes contains 0x34d5     (big_endian byte_order)
                           # nothing has been read from real data
  # ...


Example :

  # ...
  call frame_append_hexa_data (internal_frame, " e2 3f 6a 77 ");    # spaces are ignored

  uint16         val1 ;    # contains 0xe23f           (big_endian byte_order)
  uint4          val2 ;    # contains 0x6
  uint4          val3 ;    # contains 0xa
  uint8          val4 ;    # contains 0x77
                           # nothing has been read from real data
  # ...
CSS Template by Rambling Soul