Wireshark · Ethereal-dev: Re: [Ethereal-dev] General plugins

[Guy Harris <gharris@xxxxxxxxx>]

On Sat, Jul 14, 2001 at 06:38:02PM -0400, Ed Warnicke wrote:
> Yes.  For example one might put in a post dissection point into the 
> api so that I could register a function with ethereal that gets called 
> after a packet is dissected.  Then I could add a plugin that would 
> query each dissected packet to gather statistics.

Hmm.

Would this be for use when Ethereal first reads a capture file, or would
it be for, say, a Tools menu item that makes a new pass through the
capture?

If the former, note that there is no guarantee that protocol trees are
built when a capture file is first read; it's expensive to generate
protocol trees, so they're only generated if they're needed (e.g., if a
read filter is being used, or if a colorizing rule is in effect).

If the latter, another way to do this would be to have generalize
"ph_stats_new()", by having it take a callback and a "user data pointer"
as an argument, and have it call the callback with a pointer to the
protocol tree, a pointer to the "frame_data" structure for the frame,
and the "user data pointer" as arguments.