Ethereal-dev: Re: [Ethereal-dev] Registering filter fields during dissection time
Senthil,
Probably I'm not the best person to answer this, but from my personal
experience the answer is NO.
The dissection routine is called several time, by registering several
times the field, you end up exhausting the memory pretty quick. The
registration phase need to be done only once.
I think what you should do is to register all the possible fields that
can appear in your protocol, then the dissector routine will fill up
only the one that will find in the dissected packet.
I've worked on the RTPS packet dissector and the RTPS packet doesn't
have all the fields registered, dynamically the dissector understand the
content and create the protocol tree. Not all the leaves are filled up.
Fabrizio
Senthil Sundaram wrote:
Hi,
Is it possible to register filter fields from within your dissection
routine?
i.e proto_register_field_array() - can this be called from the
dissection routines? Reason being, I dont know all the fields during
the protocol registration time. I know most of the fields for my
protocol during dissection time only. The payload for my protocol is
in the form of type-length-value form, so the fields are discovered
during dissection.
This means the display filters have to be refreshed after the
dissection is complete
Is this possible?
Thanks
Senthil
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
