On Mar 4, 2007, at 6:44 PM, Shehjar Tikoo wrote:
Thanks. I've been looking at the tap mechanism as a mechanism for the
anonymizer and I see that we'll have to add calls to
tap_queue_packet(..) in every packet-nfs.c:dissect_nfs_<messagetype>
call to queue the message for the tap listener.
No, we won't.
See, for example, the protocol hierarchy tap in tap-protohierstat.c.
It attaches to the "frame" tap, which gets called after the "frame"
dissector is finished; as that's the top-level dissector that
"dissects" the packet time stamp and lengths, it's not finished until
all dissection is complete, so the protocol tree is completely
constructed at that point.
That tap's "packet" routine walks through the protocol tree.