Wireshark · Ethereal-dev: Re: [ethereal-dev] Want to add stuff to frame_data

[Guy Harris <gharris@xxxxxxxxxxxx>]

> So, the approach I was thinking of is as follows:
> 
> On any pass over a frame, we check to see if there is frame info stashed
> there, and if so, use that if we need to remember things about the frame,
> but if not, look in any association we have set up.

Yes, that's the right way to do things.  The very first pass over the
packets, when the capture is read in (or the incremental pass in a
"update the display as packets come in" capture) reads the packets in
sequentially in time order, and should be used to build up the state;
the random accesses done as you click on the packets would just read
that data, not write it, and filtering passes over those packets should
also just read the data.

> However, it seems that multiple layers may want to stash frame info for
> their own use,

Definitely.

> so it seems that what I want is a hash and routines like:
> 
>   void set_frame_info(frame_data *fd, gchar *protocol, void *proto_info);
> 
> and
> 
>   void *get_frame_info(frame_data *fd, gchar *protocol);

Yes.  You might, however, want the "protocol" argument to be the
integral "proto_XXX" value returned when the protocol registered itself
with "proto_register_protocol()", rather than a string - it might make
the hash-table searching faster (no string comparisons, hashing a
fixed-length integral value rather than a string).