On Sun, Apr 15, 2001 at 12:53:16AM -0400, Ed Warnicke wrote:
> How well do the byte selections in the data pane of ethereal deal
> with this? If I highlight a field in the dissection pane should I expect
> the discontinous sections of the data to be highlighted in the data
> pane? What about if I click on a byte in the data frame, will the
> inverse mapping work properly? What if the mapping from data in a
> packet back to fields isn't one-to-one?
Good question. I don't think that's ever been tested. It could well
not work - the code to handle that may well not even have been
*written*.
However:
> In the process of tvbuffing the dns dissector I'm looking at setting
> up tvbuffs for dns names that are backed by discontinous sections
> of the backing tvbuff. This is to handle DNS message compression
> as described in RFC 1035, section 4.1.4, page 30.
>
> The problem is that a given section of the dns message may be
> part of multiple DNS names, and therefore multiple RR via this
> compression. Thus the lack of one-to-one-ness.
...I'm unconvinced that this is the correct way to handle this. A
protocol tree item for a compressed DNS name currently, when selected,
highlights only the field, not the fields to which it points; I think
that's the correct way to handle it.
So I wouldn't create new tvbuffs for this. Instead, I'd just use
"tvb_get_guint8()" to fetch bytes from the DNS request in
"get_dns_name()", i.e. instead of
xxx = *dp++;
offset++;
I'd do
xxx = tvb_get_guint8(tvb, offset);
offset++;
and so on.