Retrieving Intra-Frame Data

Now that the addresses have been saved in the IP layer, we need to get it back so we can display it in the HTTP layer. The method used to retrieve intra-frame data is simply called IntraframeField, and it too references the name of the data to be retrieved.

Here is the code from the HTTP decoder (HTTP.dec) showing how the source and destination IP addresses are retrieved and formatted for display in the Summary pane.

/* Display Source and Destination IP Addresses, but only in Summary pane. */

FIELD source_ip (Fixed 0)

RETRIEVE (IntraframeField source_ip_address) (IpAddress) IN_SUMMARY "Source IP" 100 SUPPRESS_DETAIL

FIELD dest_ip (Fixed 0)

RETRIEVE (IntraframeField destination_ip_address) (IpAddress) IN_SUMMARY "Dest IP" 100 SUPPRESS_DETAIL

Notice that the field size is (Fixed 0). When retrieving data, we shouldn't specify a field size because the retrieved data isn't present anywhere in the current layer. Retrieved data can be used for other purposes besides display in the Summary pane. Once retrieved, you can use the field value as you would any other field value in the decoder.