[andreas.sikkema@xxxxxxxxxxx]

> Ethereal currently doesn't have a good infrastructure for handling the
> case where the data being dissected is different from the raw data in
> the packet (whether because the data in the packet is compressed or
> whether it's encrypted).

In the H.323 dissectors I use this mechanism:

Pump all data from the tv_buff into a (C++) stream, the decoder reads from the 
stream, filling in a huge datastructure. Every object in the datastructure 
has a start- and endbyte provided by the stream. I use the start- and 
endbytes to point the proto_tree_add* functions to the correct bytes in 
the tv_buff. Works reasonably, although objects with the same start and 
endbytes are tricky ;-)

-- 
Andreas Sikkema
andreas.sikkema@xxxxxxxxxxx
"While you're waiting, read the free novel we sent you.  
 It's a Spanish story about a guy named `Manual'" - Dilbert