> I just finished to port my old RPC dissector from ethereal 0.6.2 to the current
> code base. It contains some new infrastructure, so I include only NFS
> (and even this is incomplete) as a RPC dissector. Please let me know, if my
> new dissect dispatch code is usable.
To which code are you referring?
The stuff in "packet-udp.c" should perhaps ultimately go into
"packet-rpc.c"; the TCP and UDP dissectors currently contain that type
of heuristic to try to determine if a packet is of a certain type, but
that's a bit ugly.
A scheme (inspired by that of Network Monitor) in which, for any given
protocol, you have a list of protocols that could be inside it, where
the list includes:
1) protocols where you check some field like a protocol type
field or a port number field and, if it has a particular
value, the payload is of that type;
2) protocols where something in the payload itself indicates
whether the payload is of that type, and the dissector
returns an indication of whether the packet is of that type
(in which case it dissects it) or not (in which case the
containing protocol should try the next such dissector in the
list);
might be useful here. Gilbert already suggested a scheme for the 1);
adding something for 2) as well could be useful.
I suspect that a containing protocol should be able to declare what
protocols can be contained within it; the Ethernet dissector probably
shouldn't have to know that Ethernet frames can be contained inside ATM
LANE frames, for example.
However, there should be *some* mechanism to allow the user to specify
that a particular UDP or TCP port number, for example, should be treated
as a particular protocol - sometimes there might not be a good heuristic
for a given protocol, and it might not always run on a fixed port
number, either.
In addition, a contained protocol should also be able to do that, as
you're doing with ONC RPC and ONC RPC protocols with
"rpc_init_proc_table()" (the ONC RPC dissector shouldn't have to have
the complete list of known ONC RPC protocols inside it).
I'm not sure whether the containing protocol or the contained protocol
should register heuristic dissectors (of type 2).
