Ethereal-dev: RE: [ethereal-dev] Per-frame data, conversations, and some neat t hings one can
per Richard Sharpe -
> For example, because interesting info is collected in the first pass
> through the frames, one could apply that to the tree on subsequent passes.
>
> Eg, with, say an SMTP capture, one could stash the From: and To: address
> info in the conversation associated with a stream, and then it could be
> added to each frame as a hidden field, and filtered on. This would require
> a rescan though.
I do some of this in the socks dissector. We didn't have per-frame
association at that time but I did use the conversation information
to save data and create a "dummy" protocol tree entry that displayed
the socks data for the connection. I'm working on the socks dissector
to add tvbuffer support and plan to change to per-frame for some of
the data storage.
The question I have about all this is how to we show this implied
information in the protocol tree? It's usefully to see this data but
I don't want to confuse the users with a protocol tree entry that
doesn't show in the packet data.
Jeff Foster
jfoste@xxxxxxxxxxx
