Gilbert Ramirez writes:
> Here is my latest patch showing the work on the implementation of
> a better, redesigned protocol tree in Ethereal. Last time I wrote I
> said that I would work on converting the PPP and IP dissectors.
Gilbert,
Looks great. I have a couple of suggestions.
1) It should not be compulsory to register each and every
field. Complex protocols like RSVP and SMB will essentially end up
doubling their code size or more. There should be a default value for
hfindex which indicates "put this in the tree here, but I don't ever
care about filtering on it". This also gives a smooth upgrade strategy
for the various protocols - we keep adding filter registers
gradually, so we don't have to do the entire thing at one shot.We just
add HF_INDEX_DEFAULT to all calls to proto_tree_add_item. We can't
filter on these fields, but we can still decode and view them.
2) We need graphical filters which will generate these expressions. I
can work on this one.
3) BPF expression format is familiar only to people who use UNIX
sniffers & tcpdump. C expression format, on the other hand, is
familiar to basically everyone. How about accepting C expressions
(i.e. (ip.version==4) && (ip.tl>120))?
-Ashok
--
--- Ashok Narayanan ----------------------------------------
IOS Network Protocols, Cisco Systems
250 Apollo Drive, Chelmsford, MA 01824
Ph: 978-244-8387
