Wireshark · Ethereal-dev: Re: [ethereal-dev] Ascend router capture

[Ashok Narayanan <ashokn@xxxxxxxxx>]

 > Note that the offset returned by "ascend_read()" *has* to be unique for
 > each packet, otherwise you simply can't click on a packet and get a
 > detailed dissection, because the code has to be able to read the data
 > for a particular packet, given the offset.

Yes, but you can't use this offset for determining how far you are in
the file, because you don't know the length of the uncompressed
data. You have to do a lseek(fd, 0, SEEK_CUR) to determine the actual
file position of the file. And that seems to jump straight to 20K.

Incidentally, this doesn't appear to happen with uncompressed files. I 
think it is an interaction of lex and zLib.

 > Note also that the parser, and thus the lexical analyzer, are called
 > once for every packet, with the file position set before it's called -
 > see "ascend_read()".

Yeah, but lex appears to be buffering internally. I rewrote the
YY_INPUT to give it one character at a time, but it still doesn't move 
smoothly. It may be the use of file_tell in ascend.c which is causing
this buffering. I'll see how this can be eliminated.

-Ashok

-- 
--- Asok the Intern ----------------------------------------
IOS Network Protocols, Cisco Systems
250 Apollo Drive, Chelmsford, MA 01824
Ph: 978-244-8387