On Feb 10, 2011, at 11:38 AM, Bill Meier wrote:
> There are two approaches to processing the pseudo-header:
>
> 1. libpcap processes the pseudo-header and fills in a dissector-specific structure which is eventually passed to the DVBCI dissector (pinfo->pseudo_header) along with the actual data.
>
> See wiretap/libpcap.c wiretap/pcap-common.c/process_pseudo_header()
> and epan/dissectors/packet-frame.c
>
> This approach is used by most of the dissectors which need info
> such as "direction".
>
> 2. The dissector processes both the pseudo-header and the actual data.
> I.E., From the Wireshark perspective, the pseudo-header is just part
> of the captured data (similar to the code in your original patch).
>
> This is the approach used by packet-radiotap.c
>
> ---------
>
> I don't know if there are reasons to prefer the first approach even if the changes (other than the dissector itself) are slightly more extensive. (Code must be added to libpcap to handle the pseudo-header).
>
> I expect one of the other core-developers (Guy ?) can give some guidance.
At this point, I prefer the second approach. The Linux USB dissector now uses that, as of revision 32534; switching to that cleaned things up.