Ethereal-dev: Re: [ethereal-dev] filters for ethereal?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Mike Hall <mlh@xxxxxx>
Date: Thu, 10 Dec 1998 15:07:24 -0600 (CST)
On Thu, 10 Dec 1998, Gilbert Ramirez Jr. wrote:

> As Eric A. Hall said:
> > 
> > 
> > Hi,
> > 
> > I'm interested in helping to write decodes for ethereal. Is there a
> > modular, easy way to do this or does it involve C code in the sources?
> 
> So far it means writing C code.
> 
> --gilbert
> 

I think this is a good idea. Lets think about this a little. 

I do think the large, heavy use protocols should be implemented and a part
of ethereal out of the box. But, it would be cool to allow the user to
have the ability to extend the decoding process with a simple parser. 

Something like 

tagname:offset in this data segment:length
DHCP request type:4:2
DHCP requested ip:14:4

(i made those up they are not right)

simple conditionals like 

if "DHCP request type" == 4
 process_subtype( DHCP_Lease_request, 5, 30) // ie (subtype,offset,lenght) 

I made all this DNCP stuff up, I know nothing of the format, but I thought
it would make a good example. What do you guys think of adding something
like this??

Put this in a file format that ethereal can parse.. something like
<typename>.parser or something like that.

Does anyone else think this is a good idea, or should we just put all the
protocols in ethereal in C. Don't get me wrong, I think all the major
protocols that other products support should be supported in ethereal with
c code, but this would be a feature no one else has.

BTW, is anyone on the dev list at the LISA conference in Boston? I am, if
you are here send me an email.

--Mike

+===================================================================+
| Mike Hall               Real programmers dream in Java.           |
| mlh@xxxxxx          Linux rules! Everything else just works.      |
+===================================================================+
|             finger mlh@xxxxxx for public PGP key                  |
+===================================================================+