Ethereal-dev: [Ethereal-dev] enhancing xml pdml output format

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Martin d'Anjou <mdanjou@xxxxxxxxxxxx>
Date: Wed, 8 Feb 2006 16:27:20 -0500 (EST)
Hello,

I am trying to parse the PDML XML file to extract a list of TCP options. Below is a copy of what I captured. I have edited to make it narrower but all relevant fields to this enhancement request are still there. So here is an excerpt of my capture:

<field show="Options: (24 bytes)" size="24" pos="54" ... >
<field name="tcp.options.mss" showname="TCP MSS Option: True" hide="yes" .../> <field name="tcp.options.mss_val" showname="Maximum segment size: 1460 bytes" .../>
  <field show="NOP" size="1" pos="58" value="01"/>
  <field show="NOP" size="1" pos="59" value="01"/>
  <field show="SACK permitted" size="2" pos="60" value="0402"/>
  <field show="NOP" size="1" pos="62" value="01"/>
<field name="tcp.options.wscale" showname="TCP Window Scale Option: True".../>
  <field name="tcp.options.wscale_val" showname="Window scale: 0 .../>
  <field show="NOP" size="1" pos="66" value="01"/>
  <field show="NOP" size="1" pos="67" value="01"/>
<field name="tcp.options.time_stamp" showname="TCP Time Stamp Option:True"../>
  <field show="Time stamp: tsval 924985617, tsecr 517379013".../>
</field>

I would like to be able to parse this and print out the list of TCP options. But parsing it is unnecessarily complicated by the fact that everything is called "field", and that the attributes do not consistently identify the option type. As you can see, sometimes the option name is in the name attribute, sometimes in the show attribute, sometimes in the showname attribute. This is not very easy to parse.

Thank you for a great software.
Martin