> There would, I think, still need to be routines to add values supplied
> by the dissector, as I think there are some cases where the dissector
> doesn't put into the tree a value directly extracted from the packet -
> it modifies that value in some cases - and there would definitely still
> need to be routines to extract data without adding it to the tree, for
> example for fields whose value affects how the dissector handles other
> stuff in the packet.
A couple of minutes ago I realized I shot myself in the foot with all
those ideas I supplied lately. There should also be a way to let
dissectors "tell" the proto_tree where some values can be found, instead of
telling the proto_tree where they should be extracted from. From what I
understand the new tvbuff is intended for the latter case right?
For my H.323 dissector(s) I do the following:
- Extract all the bytes from the frame into an array
- Dump the array in a stream
- Let my code decode the stream
- Walk through the resulting tree to tell Ethereal where to start a new
proto_tree subtree or just add a new item to the proto_tree
During the last fase I only know the offset and length and the resulting
values, NOT the original bytes as they came into the dissector!
--
Andreas Sikkema
andreas.sikkema@xxxxxxxxxxx
"Standing barefoot in a river of clues, most people would
not get their toes wet." - Brian Kantor in a.s.r.