["Mark C. Brown" <mbrown@xxxxxxxxxx>]

Issues with this new dissector and associated patch?

Mark C. Brown wrote:

> New nettl "protocol" dissector to format nettl trace record
> header fields: subsystem, trace kind, device id, process id
> (actually kernel thread id for 10.X and later), and user id.
> Uses new nettl "pseudo" header with trace record specific
> fields which are not really "protocol" related but are part
> of each trace record.  This approach was much less invasive
> than a more elegant solution requiring changes to the wiretap
> API.
>
> Enhanced nettl file handling so that files with unsupported
> subsystem records are just flagged as "unknown" and
> file loading continues rather than throwing an error and
> stopping.


Mark