Ethereal-dev: Re: [ethereal-dev] An idea

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Ashok Narayanan <ashokn@xxxxxxxxx>
Date: Mon, 14 Feb 2000 13:29:00 -0500
> > > Or say "in this capture, UDP port XXX is for protocol YYY", or something
> > > such as that?
> > 
> > Well, something like that. f.i.:
> > 
> > Frame 		Type		From		To
> > 1.		http		2010		80
> > 2.		ftp		3030		5434
> > 3.		tcp		1010		2020
> > 5.		http		3030		80
> > 
> > And that you can say "treat frame 3 as if it were a http message" or
> > some other type.

This kinda breaks in the case of multipacket protocols like TCP (and
HTTP) - if you have a frame in the middle of a HTTP transaction, what
can you do with it? TCP streams typically have a lot of context, which
may only be available from the start (or from some discrete set of
start points in the stream, some of which may not coincide with IP
packet starts).

-Ashok



--- Asok the Intern ----------------------------------------
Ashok Narayanan
IOS Network Protocols, Cisco Systems
250 Apollo Drive, Chelmsford, MA 01824
Ph: 978-244-8387

                       "31337 h4x0r d00dz r00lz" - Anonymous