Ethereal-dev: Re: [Ethereal-dev] a question about discontinuous tvbuffs

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Sun, 15 Apr 2001 00:08:58 -0700
On Sun, Apr 15, 2001 at 12:53:16AM -0400, Ed Warnicke wrote:
> How well do the byte selections in the data pane of ethereal deal 
> with this?  If I highlight a field in the dissection pane should I expect 
> the discontinous sections of the data to be highlighted in the data
> pane?  What about if I click on a byte in the data frame, will the 
> inverse mapping work properly?  What if the mapping from data in a 
> packet back to fields isn't one-to-one?  

Good question.  I don't think that's ever been tested.  It could well
not work - the code to handle that may well not even have been
*written*.

However:

> In the process of tvbuffing the dns dissector I'm looking at setting 
> up tvbuffs for dns names that are backed by discontinous sections 
> of the backing tvbuff.  This is to handle DNS message compression 
> as described in RFC 1035, section 4.1.4, page 30.
> 
> The problem is that a given section of the dns message may be 
> part of multiple DNS names, and therefore multiple RR via this 
> compression.  Thus the lack of one-to-one-ness.

...I'm unconvinced that this is the correct way to handle this.  A
protocol tree item for a compressed DNS name currently, when selected,
highlights only the field, not the fields to which it points; I think
that's the correct way to handle it.

So I wouldn't create new tvbuffs for this.  Instead, I'd just use
"tvb_get_guint8()" to fetch bytes from the DNS request in
"get_dns_name()", i.e. instead of

	xxx = *dp++;
	offset++;

I'd do

	xxx = tvb_get_guint8(tvb, offset);
	offset++;

and so on.