Ethereal-dev: Re: [Ethereal-dev] [Q] about dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 20 Jul 2002 13:07:22 -0700
On Sat, Jul 20, 2002 at 06:15:37PM +0200, ti wrote:
> Is it possible to patch the protocol dissector tree so that the
> preamble, SOP, EOP and IPG also can be dissected?

It would be possible to add a "PHY-level Ethernet" dissector (I'm
assuming here that you're recording Ethernet), which might be in
"packet-eth.c" along with the existing Ethernet dissector.

I don't know what it means to "dissect" an inter-packet gap, however....

Or you could have a "PHY-level Ethernet" dissector that dissects *only*
the preamble, SOP, and EOP, and hands the packet data to the existing
Ethernet dissector; that wouldn't put them in the *same* part of the
protocol tree, but some would argue that's not a bug but a feature.

> Background: I�m working on a traffic recorder/replayer on the PHY level
> (hw driven) and it would be nice if I could use the ethereal software to
> analyze my recorded traffic.

How "PHY-level" are you doing?

For example, are you recording the octets of the packet data, or the raw
8B6T symbols for 100Mb Ethernet or the raw 8B/10B symbols for 1000Mb
Ethernet?

If you're recording the raw symbols, it'd be a *lot* more work for
Ethereal to dissect the packets.