Biot Olivier wrote:
> I'd propose to add all XML stuff even when printing a single packet,
> otherwise this output breaks the PDML description. Additionally, you get a
> free gift with this: merging captures in XML format will be trivial then.
>
If you mean the XML stuff in the beginning and end it wasn't there because I
picked one packet in the middle of the printout file
and forgot to put it in manually.
Now when I looked more at the main thing I wanted (hex octets per PDU) I
noticed that I probably could get that
by adding all the "value" items for a protocol or several protocols (and
using the "pos" item when doing this).
I don't know why I didn't see that yesterday.
However I think that there might be some issue regarding reassembled PDUs
that might need to be considered in some way for PDML.
The current PDML specification seems to assume that the protocol data is
just for a specific frame and not reassembled from several frames (the "data
source" concept in Ethereal) in order to be able to recreate e.g. the
ethernet-frame octets based on "value" and "pos" when reading a PDML file,
or have I misunderstood it?
I haven't been able to see how the current Ethereal version prints a
reassembled packet when using PDML format.
I tried with some captures but I got crashes with the 2003-12-06 cvs version
when I tried.
The crash seems to occur when printing the first reassembled packet in the
file.
I don't get that crash when printing in text format, so it seems to be
related to PDML output.
I used e.g. the capture netmeeting_2_IPCom attached to the following message
(frame 4 and 6 are shown as "Desegmented TCP" in Ethereal and I get the
crash for the reassembled packet in frame 8 when printing to PDML format)
http://www.ethereal.com/lists/ethereal-users/200308/msg00170.html
Crash occurs in proto_tree_children_foreach that is called from
e_print_node_pdml.
I can provide some more details from Visual C++ debugger later on if
necessary.
