[Pavel Mores <pvl@xxxxx>]

On Tue, Nov 19, 2002 at 10:34:56PM +1100, Ronnie Sahlberg wrote:

> I was thinking more of the new tap system than porting it ot other
> link types.  Thus removing the current link layer support as well and
> just rely on tap.

Yes, that was how I thought it would work in the first place.

> It would be easy with the tap system to create a mechanism where a callback
> inside the tcp-graph code would be called with the tcp-header structure as a
> parameter.
> It would also get pinfo as a parameter where it could extract the ip layer
> addresses.
> That callback could then keep track of every segment it was called with and
> store it in a file or in a linked list or something.
> 
> The filtering to only get tcp packets matching a specific conversation would
> be built in to the
> tap mechanism and automatic. The callback in tcp-graph would only see those
> packets that matched that conversation by magic.
> 
> 
> Would that help?

Yeah, sure.

However, I'm very low on time these days, effectively I moved to
something else since the graphing code has been written, so I can't
*promise* anything.  Of course, if the amount of work turned out to be
reasonable, I'll be more than happy to do it.

	pvl