Ethereal-dev: Re: [Ethereal-dev] Van Jacobson dissector.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Phil Bostley <pbostley@xxxxxxxxxxxx>
Date: Wed, 19 Dec 2001 14:00:54 -0700
Guy Harris wrote:
IP/TCP and up.  VJ does some pretty horrific layering violations for the 
sake of performance.  The idea here is (more for tetherial)

Why do Ethereal and Tethereal differ here?
Umm..   one has a gui..  one doesn't..  :-)  Seriously, a group here was going to write a tool to do some post processing on the output from ethereal.   Tetherials output is easier to grab.  They didn't want to have to look at both the compressed and uncompressed frame to build the "what would this look like if it hadn't been compressed" frame...    Thats not a good enough reason for this uglyness so..  
you end up 
with what looks like a ppp packet that was never compressed in the 
uncompressed tab framing info and all, otherwise the uncompressed packet 
tab contains only IP and up.

So presumably all you need is information from the PPP header; the PPP
dissector has no clue what information appeared *before* the PPP header,
and neither does the VJ decompressor.
Yes...    


That information can be supplied using the standard Ethereal mechanism
for that, wherein the calling dissector sets "pinfo->private_data" to
point to a local data structure before calling the subdissector.
Yes...