["Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>]

----- Original Message -----
From: "Guy Harris"
Sent: Thursday, January 23, 2003 5:27 PM
Subject: Re: [Ethereal-dev] New Features: SMB RTT statistics and TopTalkers


> On Wed, Jan 22, 2003 at 01:31:16PM +1100, Ronnie Sahlberg wrote:
> > Supports Ethernet/IP/TokenRing
>
> Hmm.
>
> At least for packets with no tunneling, so that there's only one set of
> link-layer addresses and one set of network-layer addresses, the
> link-layer and network-layer addresses are available in the
> "packet_info" structure, as "dl_{src,dst}" and "net_{src,dst}".
>
> I'm not sure what the "right" thing for a top-talkers computation to do
> is if there is tunneling

neither am i sure, but currently, if there is tunnelling and you have ip
over something over ip
these packets will (should) be counted twice in the stats.
once for the outer ip layer and a second time for the inner ip layer.
this is what imho makes most sense in how to handle tunneled protocols.

if we disregard tunneling and just accept that it is both uncommon and also
relatively uninteresting case for something like top-talkers, or as i named
it: io-users
(to have our own name for the feature, better name suggestions most welcome)
then we would not need to tap ip/ethernet/tr etc, we could just do the
nessecary magic on src/dst in
pinfo for all protocols.

feel free to modify it in whatever way you find it to be more intuitive,
generic or useful.
my implementation is only a first attempt of what made most sense to me.

best regards
     ronnie sahlberg