Wireshark · Ethereal-dev: Re: [ethereal-dev] TCP and higher level dissectors (sub-dissector s)

[Guy Harris <guy@xxxxxxxxxx>]

> The basic idea is that the TCP dissector will assume the role of ordering
> and buffering data.

That can be done regardless of whether there's a push or pull model.

> This keep all the data stream housekeeping in the tcp dissector and turns
> the sub-dissector into a set of small routines required to decode each
> field in the protocol.

Not all sub-dissectors necessarily fit well into that "small routines"
model.  Consider, for example, the ONC RPC, NFS, and DNS dissectors -
yes, all of them have to work with TCP.

Not all protocols running atop TCP are FTP-like protocols along the
lines of SMTP, HTTP, POP, IMAP, etc.; some of them are binary
message-oriented protocols, many of which run atop more transport
protocols than just TCP, and have a protocol in between them and TCP
that imposes packet boundaries (or, worse, "fragment" boundaries, as
does ONC RPC) atop the byte stream.

Now, perhaps the record-boundary part can pull an entire record from
TCP, and handle it that way.