On Tue, Oct 05, 1999 at 08:46:06AM -0500, Richard Sharpe wrote:
>
> At 09:30 AM 10/5/99 -0400, "Gilbert Ramirez Jr." <gram@xxxxxxxxxx> wrote:
>
> >Or, we could have the higher-layer protocols "import" the info by
> >walking the proto_tree. The higher-layer protocol has the proto_tree. All
> >it needs is the registration ID of the field it's looking for, like
> >hf_ip_src and hf_ip_dst.
>
> Hmmm, this looks interesting ... Now that we have this info in the tree.
>
> How do we look it up?
It's a bit complicated, involving callback functions. A brief
explanation is in this e-mail.
http://ethereal.zing.org/lists/ethereal-dev/199909/msg00045.html
proto_find_protocol_multi()'s mechanism is not an exact match for
what you need. It will find every occurence of a protocol in a proto_tree,
and call your callback function with that protocols' sub-proto_tree as
an argument.
The problem is that you [might] need to find the closest IP layer, not
all the IP layers. You might have IP-within-IP. I'm not sure about the
layering, but let's pretend it's something like this:
Ethernet-IP-IP-UDP-NBT-SMB
We'd have to come up with some functions related to
proto_find_protocol_multi(), but slightly differnet, to help the case
of walking the tree from within a dissector in order to find the first
or last protocol of a given type.
--gilbert
