Wireshark · Ethereal-dev: Re: [Ethereal-dev] Packet Classifying Code

[Guy Harris <guy@xxxxxxxxxxxx>]

norayu abd ghani wrote:
> hi, any one who can help me to figure out which
> function is responsible to do the packet
> classification. 

What do you mean by "packet classification"?  If you mean "what function 
determines whether a packet is an IPv4 packet or an IPv6 packet or an 
IPX packet or...", there is no single function that does that.

At the bottommost layer, a packet has a link-layer packet type that 
comes from metadata in the capture file (either a per-file or per-packet 
packet type) or, in some cases, from looking at the packet and trying to 
guess the packet type; that code is in the "wiretap" subdirectory.

Above that, individual dissectors might look at a type field, or a port 
number field, or might run a number of "heuristic" dissectors that look 
at the packet data and try to guess the packet type.
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev