Ethereal-dev: Re: [ethereal-dev] Dissector dispatching

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Sat, 13 Nov 1999 15:55:14 -0800
> (Note that this wouldn't work if a protocol registered itself by
> specifying a display filter expression - that dissector would have to
> know to register an expression that checked "eth.type" and "llc.type"
> and "vlan.etype" and so on.)

...unless we had "ethertype()" register a field "etype", not associated
with any particular protocol, as a hidden field, and put that into every
packet it dissects, so that Ethernet packets, and SNAP-encapsulated LLC
packets, and..., would all have an "etype" field.

If you had a capture (e.g., from "iptrace") with a mixture of link-layer
types, that would also let you find all frames with a given ethertype,
regardless of whether they were Ethernet packets, or LLC packets, or....