On Tue, 6 Aug 2002 17:37:25 -0400, Khachaturov Vassilii <Vassilii.Khachaturov@xxxxxxxxxxxx> wrote:
> I am playing with ethereal on an in-house legacy protocol.
> For this protocol (outer), the data field (outer.data) can contain
> 0 to several primitives of an encapsulated protocol (inner).
>
> I.e., the outer frame can be smth like
> outer {
> outer.field1
> outer.filed2
> ...
> outer.data {
> inner {
> inner.field1
> ...
> }
> inner {
> inner.field1
> ...
> }
> }
> }
>
> An alternative for the outer.data is to contain smth else, describing
> outer's options.
>
> The protocol is stupid enough so that there is no field in the outer{} frame
> telling how many inner{} frames are embedded.
>
> Right now I have inner declared as FT_NONE. When I add it to outer.data,
> the filter outer.inner can only be used as a boolean (i.e. is any inner
> message
> embedded in the frame or not).
>
> Suppose I want to select just thouse frames which contain more than 1
> inner frame. I would like to use 'inner' as a counter - so that (inner > 1)
> would select me what I want. Do you think it is a conceptually wrong
> idea if I try to make a patch for ethereal to "upgrade" the boolean here
> (does a label appear?) to an unsigned integer (how many times does it
> appear?)?
> This would uniformly cover many protos with multiple primitives per message,
> giving them additional filter capability.
I am unhappy about this. It only works if everybody does "inner++" instead of "inner=TRUE". The latter is the more sensible thing to do for a boolean value.
If you want to do this, the way you describe (define an "inner.count" hidden integer field and increment it every time) is much better. Either that, or find out some way to declare inner as FT_UINT?
-Ashok
> Right now, AFAIU, I must create a hidden field which is the counter
> if I want that filter for my particular protocol - which I am going to call
> outer.inner - to be
> incremented each time the outer.data dissector subroutine calls
> a sub-dissector for yet another inner frame.
>
> Vassilii
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
--- Asok the Intern ----------------------------------------
Ashok Narayanan
IOS Network Protocols, Cisco Systems
250 Apollo Drive, Chelmsford, MA 01824
Ph: 978-497-8387. Fax: 978-497-8513 (Attn: Ashok Narayanan)
