Ethereal-dev: Re: [Ethereal-dev] ITU/ANSI TCAP dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 1 Oct 2003 23:53:24 -0700
On Thu, Sep 11, 2003 at 01:46:00PM -0400, Jeff Morriss wrote:
> 1) Rewrite a bunch of the TCAP dissector to look at tag IDs as a triplet 
> (class, constructor, tag number)
> 	- this probably has negative filtering consequences: users will 
> probably want to filter on "tcap.msgtype == 0x62" instead of just the 
> tag number

They actually remember that number?  I have the Ethernet types of IPv4
and ARP, and the IP protocol numbers for ICMP and TCP, memorized, but
that's about it.

They might really want to filter on the message type name instead;
if they did that, it probably wouldn't matter whether the tag number or
the class/{primitive,constructed}/tag value were used.