Wireshark-dev: Re: [Wireshark-dev] Bug 6844 - Universal Alcatel Protocol - Reloaded - Review fo
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andreas Sikkema <h323@xxxxxxxxxx>
Date: Fri, 17 Feb 2012 23:53:30 +0100
On 2/15/12 4:10 PM, Jeff Morriss wrote:
> Why not practical?
> 
>> $ egrep -c "static .?int hf" epan/dissectors/* | sort -t : -n -k 2 |
>> tail -3
>> epan/dissectors/packet-nbap.c:3284
>> epan/dissectors/x11-declarations.h:7119
>> epan/dissectors/packet-rrc.c:8403
> 
> 
> (Admittedly those 3 are all generated dissectors, but I also imagine
> you're not dealing with *quite* that many fields...)  But these
> dissectors are both manually generated:

The original H.323 dissector I wrote eons ago had hundreds if not
thousands of fields one could filter on. Every single element in the
ASN.1 specs (H.225, H.245) was generated into a proto_item. This was in
the Ethereal 0.4 (?) days... It had *thousands* of variables contained
in a couple of C++ structs (did you know there's a limited amount of
member variables in a struct?).

So I wouldn't be afraid of adding lots and lots of filterable fields to
a dissector. The more the better.

-- 
Andreas Sikkema