----- Original Message -----
From: "Guy Harris"
Sent: Friday, November 14, 2003 12:41 PM
Subject: Re: [Ethereal-dev] improved NTP decoding
>
> On Nov 13, 2003, at 12:06 AM, Ronnie Sahlberg wrote:
>
> > From: "Andreas Sikkema"
> > Sent: Thursday, November 13, 2003 8:59 AM
> > Subject: Re: [Ethereal-dev] improved NTP decoding
> >>
> >> Matthias Drochner wrote:
> >>
> >>> It is fine from the NTP point of view -- I just wasn't sure it is
> >>> legal
> >>> to use one hf_* node multiple times within one packet. The
> >>> documentation
> >>> isn't clear about this. In real live as far as I've seen, multiple
> >>> extensions didn't happen. So I couldn't test and preferred to be
> > conservative.
> >>
> >> It is not unusual for H.323 packets to contain multiple instances of a
> >> certain construct, which means, multiple instances of an hf_ value.
> >>
>
> > In the standard yes, in Ethereal no.
> > The current set of h.xxx protocols in ethereal should not have
> > conflicts or
> > multiple hf fields that share the same filter name
> > to avoid this very issue.
>
> There might be some confusion over what "multiple instances of an hf_
> value" means here.
>
> You can have multiple hf_ variables with the same name - see, for
> example, the X.25 dissector, where fields such as P(S), or "x.25.p_s",
> have more than one hf_ variable, one for mod-8 and one for mod-128.
The h.xxx functions do not do that. All names such as "h225.foo.bar" are
associated to exactly one
hf variable.
>
> You can't have multiple names for the same hf_ variable. That's what
> it sounds as if you're referring to.
No, and the h.xxx dissectors dont do this either.
Each hf variable is only associated with exactly one name.
