["Guy Harris" <gharris@xxxxxxxxx>]

Juergen_Fischer@xxxxxx said:
> Is there a possibility to enhance ethereal's analysing capabilities in
> such a way ?

It's possible - code to do that could be added to the dissectors for
protocols, or taps could be added to the dissectors with the "expert
analysis" done in taps.

Whether somebody'll take the time required to implement it is another
matter; it'd probably be done by somebody who has an immediate need for it
(meaning it'd probably be somebody who uses it for network administration
purposes, rather than to debug software on which they're working).