Ethereal-users: Re: [Ethereal-users] Ethereal's Architecture

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 15 Jan 2002 00:29:41 -0800
On Mon, Jan 14, 2002 at 08:18:41PM +0800, darren wrote:
> 1) 	How does it decide which protocol-layer to start decoding? 

As the reply to your other message said, it determines it from
information supplied in the capture file header; if Ethereal is doing
the capture, the information it puts in the capture file header comes
from libpcap.

> 2)	How does it decide which Packet Dissector to use?

Ethereal typically doesn't use a single packet dissector; it starts out
calling one dissector, and that one then calls other dissectors, and so
on.

There are several mechanisms in Ethereal for choosing which dissector to
call; different dissectors use different mechanisms.

> 3)	How to add new dissectors?

See the various "README.*" files in the "doc" directory of the Ethereal
source tree.