["harshas" <harshas@xxxxxxxxxxxxxxxxxxx>]

Hello,

  I am using ethereal 10.7 and  on LINUX machine.

      Using ethereal I could read a captureed file with 'n' number of packets (header and rawbytes).

  1.  My question is Ethereal dissection routine is called only when a packet is selected randomly through seek_read routine.The raw bytes present in the tvbuff will

 be accessed and decoded. is it right?

  2. If so Every time  a packet is selected randomly ethereal dissector will get the corresponding raw bytes of the packet from tvbuff . Whether the bytes are read from the captured file each time when seek read is called or all the bytes of all the packets are read once during the file read?.

  3. If read once during the file read How the raw bytes of the individual packets are stored? If the number of packets and the corresponding bytes are more will ethereal gives any overflow message?

 

Please answer me these basic doubts regarding ethereal.

 

Thanks in advance

      Harsha