Hi list
attached diff includes an update version of virtual packets and ip
defragmentation.
please consider this for inclusion of cvs (after tuesdays release?)
it works quite well.
virtual packets is a generic and easy to use api
apcket-virtual.c:inject_packet()
which can be used to insert arbitrary packets into ehtereal during run-time.
These packets are only for display and analysis only and should not be part
of any capture files.
One application of virtual packets exists today: defragmentation of ip
packets.
Other potential applications might be
IPComp : show uncompressed packets as virtual ones.
IPSec : If user has specified encryption keys, show decrypted packet as
virtual.
etc etc
defragmentation of ip packets is the other main change in the enclosed diff.
Defragmentation of ip packets is controled by a button in Preferences/IP
Please note that the use of IP Defragmentation will increase the memory
requirements
of ehtereal so large captures which were barely workable in ehtereal before
might
be too much for ethereal to handle with this option enabled.
When defragmentation is on, ehtereal is changed in the following ways:
* Upper layer dissectors (TCP/UDP/ICMP/IGMP/...) will no longer be called
for any
ip fragments. Not even the first fragment.
* When sufficient fragments have been received to defragment a packet, this
packet will
immediately be injected into ehtereal as a VIRTUAL packet. This packet is
not fragmented
and upper-layer dissectors will be called.
(This is good since with this option, upper layer dissectors will never ever
see fragments again.
As far as TCP/UDP/... are concerned, IP can no longer be fragmented.
This will make certain intelligent things in upper-layer dissectors MUCH
easier.
This has been tested quite a lot and seems to work quite well.
One can enable/disable ip defragmentation during a capture and no bad things
seems to happen.
I would be happy if it could be merged into cvs immediately after the
release on tuesday.
I think it should definitely not be part of the upcoming release since this
code is a lot more
than the average dissector, it messes quite a bit with how file.c works and
changes some vital
structures, it should have a lot more testing before becoming part of a
public release.
When this one is inside cvs, I might start looking at adding support to
tethereal for virtual packets
and defragmented ip packets. Currently only ethereal can use these.
best regards
ronnie s
Attachment:
ethereal.diff
Description: Binary data