Wireshark · Ethereal-dev: Re: [Ethereal-dev] tapping commentary

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Oct 22, 2002 at 10:37:30PM +0000, Pia Sahlberg wrote:
> No, I understand that. But, shoud this feature be tied to actually
> clicking on the menu item or should it be a sideeffect of the menu-item 
> calling  gtk_rpcstat_init() and then gtk_rpcstat_init() makes the nessecary 
> calls to do a rescan.

Presumably

	1) the user wouldn't see any difference

and

	2) a rescan would be done in both cases

so it wouldn't matter.

> OK. I can provide a patch that adds this variable to the _packet() callback.
> Should I pass edt  or edt->tree   (does edt hold any other useful 
> information besides ->tree?) to the callback?

I was originally thinking edt->tree, but the epan_dissect_t also
contains the "packet_info" structure for the packet that was dissected,
and that information might be of use to callbacks as well, so I now
think you should just pass edt.

> OK.   Can actual field values like the value of "ip.addr" be extracted from 
> edt->tree?

Yes.  Currently, it may be a bit of work, as the routine would have to
walk the tree itself, but it can be done.

"proto_registrar_get_byname()" looks up a field name and returns a
"header_field_info *" for that field (or for the first of the fields, if
more than one field has that name, e.g. as was done for mod-8 and
mod-128 X.25).  The callback can walk the tree looking for that node.