Ethereal-dev: Re: [Ethereal-dev] rsync - conversation candidate?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 15 Oct 2002 20:15:23 -0700
On Wed, Oct 16, 2002 at 12:51:40PM +1000, Brad Hards wrote:
> I'm finding this hard to decode, because the way each packet needs to be 
> treated depends on the packets that have gone before.
> 
> I'm guessing I need to use the "conversation" routines for a problem like 
> this. Is this so?

Yes.

> I've read the Section 2.2 bit of README.developer a couple 
> of times (and there are many, many times to go:). Any other hints?

Take a look at the SMTP dissector; SMTP is another dissector where the
way each packet needs to be treated depends on the packets that have
gone before.

The SMTP dissector attaches to the conversation a data structure that
keeps the current state, so that, on the first pass, when all packets
are being read in and dissected sequentially, the information about the
way to treat the current packet, based on the previous packets, is
available.

It *also* attaches to *frames* a data structure giving enough
information to dissect the frame correctly, as, after the first pass is
done, there's no guarantee that frames will be accessed in sequential
order - the user can click on whatever frames he or she wants, in
whatever order he or she wants.