Ethereal-dev: Re: [ethereal-dev] TCP/UDP protcol dissector lookups

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 2 Mar 2000 11:38:41 -0800 (PST)
> I checked the conversation.c code because it sounded like something I
> could use in a socks dissector.  Just one problem;  how does this
> function on a trace that does a router hop ?  For example:
> 
> 	router ----------> hub -----------> server (10.2.1.2)
> 	(10.1.1.1)			\		
> 	(10.2.1.1)			 \--------> client (10.1.1.2)
> 					  \		
> 					   \------> ethereal computer
> 
> When I looked at adding "conversations" I realized that this would be a
> problem unless I had both the DLC and IP addresses in the key.

Eh?

The conversation is between host 10.1.1.2, port XXX, and host 10.2.1.2,
port YYY.  It's irrelevant whether the packets travel through host
10.1.1.1/10.2.1.1, or host 66.66.66.66, or host 137.1.1.1, or... in the
process of getting between 10.1.1.2 and 10.2.1.2 - different packets in
the same conversation could well travel through *different* routers.