[Guy Harris <gharris@xxxxxxxxx>]

Ph. Marek wrote:

> as a step to comparing captures I'd like a simple feature included in 
> ethereal: having some kind of hash-value (MD5, SHA-1, possibly CRC-32) for 
> the various levels of packet dissection.

So would it compute all of the types of hash, or would the type of hash 
differ for different parts of the packet, or would the type of hash be 
user-selectable?

> Eg. having a hash for the ethernet-packet,

"Ethernet packet", meaning "the Ethernet header and the payload", or 
"Ethernet header", meaning "the first 14 bytes of an Ethernet packet"?

> for the IP-part, the TCP-part, and possibly sub-dissectors.
>
> This would help finding corresponding packets in simultaneously done sniffer 
> dumps, and allow checking for corruptions easily (think NAT, where some part 
> is legitimately changed, but others below must not).

So where would these hashes appear?  As protocol tree items (so that 
display filters can compare hashes)?