I've written some decoding routines for some proprietary network
messages. These messages are layered on TCP. Due to several
conditions, there can be many of these messages in one network frame.
One of the main developers of this software asked if I could put a short
summary of the contents of each message on the "Summary" (Info column)
line. I've shortened the name of each command that gets processed for
summary line display, but still come up with some very long lines.
The summary I'm putting out for requests is something along the line of
"command object1 object2", and for responses
"response object1 Error:object2" if there was an error commanding one of
the objects. The current size of 256 bytes is nowhere near big enough
to store the information for one frame of messages.
I initially just bumped COL_MAX_LEN from 256 up to 4096, but that seemed
rather wasteful and prevented me from running against large capture
files until I straightened out a rather marginal virtual memory
configuration on my workstation.
What I have at the present time is a second definition:
COL_MAX_INFO_LEN, which gets used when the column type is "info".
I've also written a "col_append_str" routine to append each message's
information to the data already stored in the desired ("info" in this
case) field. Right now this routine uses strlen and strncat, so isn't
as efficient as the method used internally in packet-tcp.c. However, we
should have a general purpose routine to do appending so that each
module that needs this functionality doesn't have to duplicate the
effort.
This seems to be something that others would want to do, so I'm hoping
to get this functionality built in, rather than having to make the
changes for each new release.
If you want the specific changes made to incorporate these changes, let
me know and I'll provide diffs of the affected routines.
On a related note, I moved the padding check from ethertype.c to
packet-ip.c and added a "Truncated" check. I need to change it slightly
though, as the "truncated" or "padded" message I put in the "Info"
column gets blown away at the next layer (duh!).
Comments?
Thanks,
Phil Techau
