Ethereal-dev: Re: [ethereal-dev] Splitting/duplicating packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Mon, 10 Jul 2000 23:37:31 -0700
On Tue, Jul 11, 2000 at 04:38:50AM +0000, Adam Fritzler wrote:
> I'd rather not dissect them just sequentially since doing that, as I
> understand it, would not let me filter in a logical way.  (For instance,
> if there was a packet that contained a channel 1 FLAP and a channel 4
> FLAP, and the filter rule was "aim.flapchan eq 1", then it wouldnt match
> since the channel 4 was last and the value of the field would last be 4.

If your dissector dissected both the channel 1 FLAP and the channel 4
FLAP, there would, in the protocol tree for the packet, be an entry for
"aim.flapchan" with a value of 1 *and* an entry for "aim.flapchan" with
a value of 4.

There's no notion of "the" field of a particular type in a packet's
protocol tree; there can be multiple instances of a field in the
protocol tree, and each of them can have a different value.

I.e., dissecting them sequentially should work just fine.  Don't worry,
be happy.