Wireshark · Ethereal-dev: Re: [ethereal-dev] Modifying the packet buffer in dissectors

[Marcus Haebler <mhaebler@xxxxxxxxx>]

Guy Harris wrote:
> 
> > Is there a clean way to change the contents of the packet buffer
> 
> I'd copy the buffer and change that instead.  I could imagine that in
> the future the buffer might, in some cases, be part of an mmapped region
> of a capture file; if so, it'd be mapped MAP_SHARED (on UNIX, and the
> equivalent on Win32) and read-only (mapping it MAP_PRIVATE would mean
> a copy-on-write *and* would mean that the next fetch of the packet would
> get the modified data).

Do you mean copy it to a new tvbuf as proposed in the next lines?


> > As
> > of now I cannot see a mechanism in the tvbufs that would allow
> > this except for creating a new real data tvbuf which will generate
> > even more overhead in the costly decryption dissector.
> 
> Is the extra overhead of creating a new tvbuff very large compared to
> the decryption overhead?  Or would it just be in the noise?
Rethinking it, the copy might just be in the noise. BTW I am using
openssl (http://www.openssl.org/) as a library for decryption and
authentication algorithms. It has the great advantage of also compiling
on Win32 and it should work greatly together with ethereal licencewise
(provided I get the OK from my management).

If I have some free personal time myself, I might just add support for 
transparent IPComp and submit the changes back to the source tree.

Marcus