[Tim Potter <tpot@xxxxxxxxx>]

On Fri, Oct 24, 2003 at 11:35:14PM -0700, Guy Harris wrote:

> ...but what your stuff does is actually do dissection.
> 
> This means, of course, that it has to do it *without* building a
> protocol tree (unless you add stuff to *remove* any partial dissection
> from the tree), *and* without modifying any of the columns (unless you,
> again, undo all it did).

This is the point that I have reached - wondering what to do about all
the protocol tree that the dissector has built up.  It sounds like too
much work to try and undo it.  )-:

> It also means that, as with heuristic dissectors, it won't necessarily
> work if you have short frames or un-reassembled PDUs - but it's more
> likely to fail in that case, as it has to decode the entire packet.

Didn't think of that one, as well as a couple of other points you made
in the previous message.  Ah well.  


Tim.