Ethereal-dev: Re: [Ethereal-dev] improved NTP decoding

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 13 Nov 2003 17:41:45 -0800

On Nov 13, 2003, at 12:06 AM, Ronnie Sahlberg wrote:

 From: "Andreas Sikkema"
Sent: Thursday, November 13, 2003 8:59 AM
Subject: Re: [Ethereal-dev] improved NTP decoding

Matthias Drochner wrote:

It is fine from the NTP point of view -- I just wasn't sure it is legal to use one hf_* node multiple times within one packet. The documentation
isn't clear about this. In real live as far as I've seen, multiple
extensions didn't happen. So I couldn't test and preferred to be
conservative.

It is not unusual for H.323 packets to contain multiple instances of a
certain construct, which means, multiple instances of an hf_ value.


In the standard yes, in Ethereal no.
The current set of h.xxx protocols in ethereal should not have conflicts or
multiple hf fields that share the same filter name
to avoid this very issue.

There might be some confusion over what "multiple instances of an hf_ value" means here.

You can have multiple hf_ variables with the same name - see, for example, the X.25 dissector, where fields such as P(S), or "x.25.p_s", have more than one hf_ variable, one for mod-8 and one for mod-128.

You can't have multiple names for the same hf_ variable. That's what it sounds as if you're referring to.

You can have multiple nodes in the protocol tree that use the same hf_variable. I think that's what Matthias Drochner was asking about.