Re: [Wireshark-dev] Splitting one packet into multiple packets

2011-02-26 Thread Guy Harris
On Feb 24, 2011, at 12:31 AM, Roland Knall wrote: > I figured there are 2 ways of achieving this: > > 1. Use a DisplayFilter - but so far I have not found a solution using > this approach. That's because no such solution exists. All a display filter does is limit the frames that get displayed

Re: [Wireshark-dev] Splitting one packet into multiple packets

2011-02-25 Thread Roland Knall
Hi > ... so the split then would mainly be for the user, so he can easily filter > for a particular sub stream, i.e. module ? Yes, that would be the main motivation. > I don't know how to create new 'root' objects. If there's some relation > between the different frames for the same module, mayb

Re: [Wireshark-dev] Splitting one packet into multiple packets

2011-02-25 Thread David Aggeler
Roland I would like to be able to dissect those packets individually and not displaying one big frame. ... so the split then would mainly be for the user, so he can easily filter for a particular sub stream, i.e. module ? I don't know how to create new 'root' objects. If there's some relation

Re: [Wireshark-dev] Splitting one packet into multiple packets

2011-02-24 Thread Roland Knall
Hi Yes, that is exactly what I want to see. Let me explain for a second. I work for a company, developing SPS systems for machines. One of our system uses a so called "Bus Controller" which communicates using a Realtime Ethernet Protocol like Sercos III oder Powerlink V2. "Behind" this Controller

Re: [Wireshark-dev] Splitting one packet into multiple packets

2011-02-24 Thread David Aggeler
Roland, Do you want to see the following: -- FRAME 1 -- ETHERNET II FRAME -- IP FRAME -- UDP FRAME -- MY PROTOCOL FRAME 1/4 -- FRAME 1 -- ETHERNET II FRAME -- IP FRAME -- UDP FRAME -- MY PROTOCOL FRAME 2/4 etc? Why that? Do yo have a post processing step that relies on this? wireshark is a p

[Wireshark-dev] Splitting one packet into multiple packets

2011-02-24 Thread Roland Knall
Hello I have the following situation. The trace identifies (correctly) packets I am interested in. These packets come from a device, which collects packets, puts them together into one udp frame, and sends them over the network. Right now I trace the udp payload, and call the packet dissector for