Wireshark · Ethereal-dev: Re: [ethereal-dev] suggested feature...

[Gilbert Ramirez <gram@xxxxxxxxxx>]

On Tue, Oct 19, 1999 at 10:20:53AM -0500, Neulinger, Nathan R. wrote:
> 
> 
> Actually, no, I really meant to just have it ignore a protocol.
> 
> The filtering is simple - just type in one of the fields, i.e. "tcp" will
> only show packets within the tcp protocol.

One way to implement this in Ethereal is to:

1. Have the proto_* routines provide a list of protocols
2. Have a GUI to enable/disable protocols using the list from #1,
	saving the boolean information in a new field in the
	header_field_info struct.
3. Have the dissectors decide what to do with this info.

The choice (#3) could be made in two places, either before the "parent"
protocol calls the "child" protocol, or once the "child" protocol begins
processing. I like placing the decision in the "child" protocol so
that the information about that protocol is in one place, and the
variable representing the registered protocol can be static within
the protocol module, and not have to be exported for all protocol
dissectors to access.

For example:

void dissect_sna(....) {

	if (!proto_is_enabled(proto_sna)) {
		return; /* or dissect_data() --- configurable by user? */
	}

	/* ... proceed with dissection */
}

--gilbert