[Guy Harris <gharris@xxxxxxxxx>]

Jacques, Olivier (OCBU-Test Infra) wrote:

> here is a small patch for the flow graph feature. It allows to have SS7
> nodes (network indicator/point codes) to be recognized as nodes in the
> graphs.
> The patch consists in using "pinfo->net_src" or "pinfo->net_dst" instead
> of "pinfo->src" or "pinfo->dst".
> I did some tests with other IP protocols and behavior was still the same
> as before. But I do not guaranty that it doesn't have some bad side
> effects for some protocols.

This indicates that perhaps the model of "data link layer" and "network 
layer" addresses isn't sufficient.  Perhaps we need to generalize that 
model.

One possibility would be to have "stacks" of source and destination 
addresses, with calls to find, searching downward from the top of the 
stack, the first address:

	of a particular AT_ type;

	of any IP type (AT_IPv4 or AT_IPv6);

	of any "network-layer" type (with a suitable definition of 
"network-layer");

	of any "link-layer" type (with a suitable definition of "link-layer);

	etc..

The network columns could then be set to display the topmost address of 
any of the types those calls can find; that would mean that you could, 
for example, arrange to show the topmost IP address for any traffic that 
involves IP, even if the protocol encapsulated over IP has its own 
address type, or you could arrange to have it show the topmost address, 
whatever it might be.