Michael A. McCartney wrote:
Changing it to what we discussed would break what I have
and worst, probably would force me to hack packet-eth which
I'd rather not do. Seems eth is a special case where both
the "framing" needs to be heuristic (as is now and used) as
well as the "payload" (not present like tcp/udp). Is it
possible to do both, or is it either-or?
It's not possible to do both with the same mechanism.
There would need to be two heuristic dissector tables, one used before
the Ethernet dissector does any work, and one used after it's dissected
the Ethernet header.