[Guy Harris <gharris@xxxxxxxxx>]

On Thu, May 08, 2003 at 04:43:05PM +0800, Ian Cunningham wrote:
> I can see the FollowTCP Stream tool.  It is excellent.  But can I add
> my own dissector on top of it? That is avoid managing the reassembly of
> the TCP segments.

No.  "Follow TCP Stream" just reassembles the data in the stream itself,
and displays it as text, under the assumption that either

	1) the protocol being used in the conversation is an all-text
	   protocol (or enough of it is text that displaying it in that
	   fashion is convenient - for example, an HTTP sequence
	   fetching pictures might still be useful if displayed in that
	   fashion if the user looking at the trace doesn't care about
	   the contents of the pictures, just the HTTP protocol traffic)

or

	2) the user can figure out binary protocols by looking at them
	   as they're displayed in whatever character set is being used. :-)

A mechanism to allow a protocol to intercept the data itself for "Follow
TCP Stream" might be useful to handle cases where neither 1) nor 2) is
true (or where 2) is true but the user would prefer not to *have* to do
that :-)).  No such mechanism currently exists, however.