On Fri, Oct 15, 1999 at 09:40:34AM -0500, Gilbert Ramirez wrote:
>
> Actually, the display filter is supposed to work on tunnelled protocols;
> it's
> supposed to look in both of the ipv6 headers for the ipv6.dst that you
> specify. I tried to make it work, but since I never had a tunnelled
> protocol
> on which to test, it turned out that my code didn't work.
I fixed the problem regarding display filters on tunnelled protocols.
The dfilter code was working right; it was the elem_size in the
dfilter_mknode() calls that was wrong. So, now, ipv6.dst == xxxxxx
will match on _either_ ipv6 header in a tunnelled packet.
That still leaves open, however, the question of how to display tunnelled
protocols. We can show ipv6/udp/data as children of PIM, or as siblings
of PIM.
The display filter code right now assumes that all protocols exist at the
topmost layer of the proto_tree. So, if we move the second ipv6 header
to be a child of PIM, then the dfilter code as it is now won't match
ipv6.dst against the address in the tunnelled ipv6 header. (The dfilter code
tries to be quick about things --- it looks for all instances of ipv6 at
the top level of the proto_tree, and then searches for ipv6.dst in each of
those subtrees).
If it is important to be able to filter on that tunnelled ipv6.dst, *and*
we want to display tunnelled protocols a child trees of the tunnelling protocol,
I'll have to modify the dfilter code to look for protocols everywhere. That's
no problem; I can do it, I just wanted to let people know what would have to
change.
Would an option to show tunnelled protocols as _either_ top-level protocols or
as children protocols be useful? It should be easy to check in dissect_pim() what
the user wants, and pass 'tree' or 'pimopt_tree' as appropriate.
--gilbert
