Wireshark Plugin: Get total packet size in wireshark packet dissector

Question

How can I read the packet size that was recieved in wireshark-dissector? Is that data aviliable from the tvbuff_t?

Answer 1

If by "packet size" you mean the size of the data handed to the dissector in the tvb, then:

tvb_reported_length(tvb) is the size as seen on the wire;

tvb_length(tvb) is the size as actually captured (which can be less than the size on the wire).

In either case, the size returned is that of the data handed to the dissector(i.e., not including any of the lower level headers (ethernet, etc)).

---

If you want the size of the complete packet as originally seen on the wire or as saved)

pinfo->fd->pkt_len   // packet-len
pinfo->fd->caplen    // amount actually captured

(See epan/frame_data.h) in the dissector source tree).

Dissectors do not (i.e., should not) normally need to access info about the actual full size of the frame.

If this is the data needed, if you can indicate why this data is needed, then I may be able to suggest a different approach.