Please find attached a patch for packet-clnp.c. It adds fields for source
and destination TSAP for COTP.
1. As COTP does not define the format of TSAPs, the current Ethereal
implementation looks at whether the data contains printable ASCII bytes and
either outputs a string or a byte representation. In my environment (ICL
OSLAN), TSAPs are always bytes, e.g. 0x5610 and I wanted an elegant way of
constructing filters to allow me to express such TSAPs in filters as bytes.
At the same time, many COTP implementations will use printable strings. So I
came up with the following implementation:
* There are four new fields:
cotp.src-tsap,cotp.src-tsap-bytes,cotp.dst-tsap,cotp.dst-tsap-bytes. Using
source TSAPs as the example, if the dissector encounters a source TSAP
variable parameter it will add both a cotp.src-tsap and a
cotp.src-tsap-btyes to the tree. One, however, will always be hidden.
* I have added a new preference option to the dissector, tsap_display that
has three settings: auto, string or bytes. If the option is set to default,
then the choice of which field to make hidden will be determined by the "is
it ASCII and printable" routine. If 'string', then it will always be the
cotp.src-tsap-bytes and cotp.dst-tsap-bytes that hidden; if 'bytes' then it
will always be cotp.src-tsap and cotp.dst-tsap bytes that are hidden. The
default is 'auto'.
Is this solution OK? Are there any better ways of achieving the same end?
2. As stated above, I only have two byte TSAP fields to test with. I would
appreciate if someone could test the patch with some printable string TSAP
COTP, or mail me a capture to test with.
The patch was written and tested against 0.10.3.
All feedback and criticism welcome.
Matthew
Community Network Services Ltd.
204-207 Western Docks, Southampton, Hants. SO15 1DA
Switchboard : +44 (0)845 6589920 Fax : +44 (0)2380 799602
Help Desk : +44 (0)845 6589930
http://www.cnsonline.net/
Reg. no. 2084279 England
*************************************************************
All views or opinions expressed herein are solely
those of the author and do not necessarily represent those
of Community Network Services Ltd who do not accept
liability for any action taken in reliance on the contents
of this message (other than where the company has a legal
or regulatory obligation to do so) or for the consequences
of any computer viruses which may have been transmitted
by this E-Mail
The E-Mail and any files transmitted with it, are confidential
and intended solely for the use of the individual or entity to
whom they are addressed. If you have received this message
in error please notify the sender and delete the message
immediately or alternatively email postmaster@xxxxxxxxxxxxx
***************************************************************
Attachment:
packet-clnp-tsap.diff
Description: Binary data
