On Fri, 29 Mar 2002, Guy Harris wrote:
> If you *had* the header_field_info pointer, you could.
>
> However, the only way to get the header_field_info pointer, at present,
> would be from the TCP dissector, or from a call to
> "proto_registrar_get_nth()" - but the argument you'd hand to
> "proto_registrar_get_nth()" is the "hf_" number for the field, and
> that's *also* private to the TCP dissector.
>
> The TCP dissector does not export that information.
>
> Therefore, you would have to modify the TCP dissector to export that
> information, unless you plan to put your statistical stuff *into* the
> TCP dissector.
>
Right, I've been on the lookout for these header_field_info pointers as
they seem to be the key to achieving what I want to do.
I have been looking in packet-tcp.c, but am confused as to what they
look like.
A lot of variables are dclared at the start of the file e.g.
static int hf_tcp_hdr_len = -1;
These only seem to be used in registering the protocol.
Where abouts is the "hf_" number for a field declared? or is this done
at run-time when the protocol is registered?
Is the line:
struct tcpinfo *tcpinfo = pinfo->private
where everything (i.e. the header_field_info pointers) are made private
to the dissector?
How difficult would it be (if I can find them) to export the
header_field_info pointer information? as this would be the preferable
way of doing this, rather than putting code into the dissector.
However, I'm looking to firstly get the thing working before looking to
make it all neat and tidy, so any suggestions are welcome.
Thanks
--
Phil Williams
e-mail to csypbw@xxxxxxxxxxxxxxxx
