Wireshark · Ethereal-dev: [Ethereal-dev] Changing data in the byte view ...

[Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>]

Hi,

Andrew Tridgell suggested an extension to Ethereal that might be useful. 
Apparently, NetMon has something simular.

The concept is, especially when you are trying to implement a protocol, it 
would be nice if you could select a bunch of bytes in the byte view, and 
then change them and have Ethereal re-dissect the data. This would be 
especially interesting when you have a problem with your implementation.

In talking to Guy, we figured that we could construct a new TVB and then 
hang it off the per frame data associated with the frame that was 
modified.

Of course, there are some other issues to be dealt with. For example, if 
the user goes to save the capture, do you save the original data, the 
modified data, or what? Should there be a check box in the Save-As dialog 
box to enable this? Should there be a menu item to erase all 
modifications?

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com