Wireshark · Ethereal-dev: Re: [Ethereal-dev] tapping commentary

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Oct 15, 2002 at 08:15:14PM -0400, Jason House wrote:
> I can envision the need for a more selective tap calling trigger than a
> packet of the right type being encountered.  It would be nice to have a
> tap listener called the first time that a packet is processed (or every
> time except the first time).

It'd also be nice to be able to run taps from menu items; a
re-dissection pass would be made through all the packets when the menu
item is selected, with the tap listener being called.

In addition, it'd be nice to have a tap that requires *no* dissector
changes, and that just gets handed a protocol tree - or that registers a
set of fields and gets handed some data structure with the values of
those fields, if present.

The combination of the two of those might allow the TCP stream analysis
to be implemented as a tap, for example (and, as a side effect, no
longer have to do its own link-layer, IP, and TCP parsing, so that it
can work atop *any* link-layer protocol).

On top of that, it'd be nice to have taps as another type of plugin, in
addition to the dissector plugins we have now.