You could do a combination of 1 and 2, but split the
conversion/formatting into a separate set of routines.
That way, the display/filtering code uses a standard format, but the
application developers can just feed it in the format that it comes from
their packet - or they can use a simple standardized routine for doing
the conversion to pass in.
You could use the BASE_* field to overload for time format conversions.
One possbility is also going to a field-type/field-sub-type mechanism,
although that would likely be messier in some aspects.
(Quick, somebody put the lid back on that can I accidentally opened.)
-- Nathan
Guy Harris wrote:
>
> > Yeah, I could probably just convert them to timevals in my code, but this
> > seems handier. One less thing that the dissector has to worry about.
>
> Hmm.
>
> Ethereal may have to deal with some other time stamp formats as well:
>
> the N different formats that have crept into SMB over time;
>
> NFS V3 timestamps (which are similar to "struct timeval", only
> they have nanosecond rather than microsecond resolution)
>
> and perhaps some other ones.
>
> (SMB currently doesn't put time stamps into the protocol tree as
> filterable fields, it just puts the line in as text, but I don't know if
> that'll forever remain the case.)
>
> Is the right way to handle this
>
> 1) to convert to a "standard" format and shove the value, in
> that format, into the protocol tree (that's how you do it in
> Microsoft Network Monitor)
>
> or
>
> 2) to add protocol-tree data types for all formats
>
> or
>
> 3) do 1) for some formats and 2) for others?
>
> 1) has the advantage that the filtering code and the display code
> doesn't have to worry about N different time formats, and the
> disadvantage that every field that isn't in that format has to be
> converted.
>
> 2) has the advantage that dissectors can just put in entries without
> converting times, and the disadvantage that the filtering and display
> code has to deal with N different time formats.
--
------------------------------------------------------------
Nathan Neulinger EMail: nneul@xxxxxxx
University of Missouri - Rolla Phone: (573) 341-4841
Computing Services Fax: (573) 341-4216
