Wireshark · Ethereal-dev: Re: [Ethereal-dev] writing a function

[Ed Warnicke <hagbard@xxxxxxxxxxxxxxxxxxx>]

Here are my thoughts on your proposals...

On Sat, 30 Dec 2000, Guillaume Le Malet wrote:

> HI!                                                                   
> Now that I can compile and that I read DOCs and had a look            
> to the source I think it's time to begin to write something.          
> I'm thinking about one of those fonctions that are following.         
> (I would like to know which one would be the easiest to write).       
>                                                                       
>                                                                       
>                                                                       
> -The ability to set up "Alarm filters", which run a command or play a 
> sound when a match is found.                                          

This might be quite useful.  My general tendency was to think of 
eventually building language bindings out to scripting languages like 
perl and python in order to do more complicated extentions of the current
filtering mechanism, but having a packet that matches launch some external 
event might be quite doable.  

>                                                                       
> -Icons for each tree view entry.                                      

What exactly do you mean by this?  If you could provide a more complete 
explanation of this I might get a better idea of its utility.

>                                                                       
> -The ability to generate real-time graphs of packet sizes, types of   
> data, response times, etc. Output should be in ASCII (data dump), GIF,
> or PostScript(R). Perhaps something similar to tcptrace?              

It would strike me that this could potentially be hugely useful.  We
currently keep some bulk statistics in ethereal, but it would be nice 
to be able to do more and to be able to display it reasonably.  
My only thought would be to be careful to maintain strong modularity.

>                                                                       
> -Selecting Edit/Copy should copy packet data into the copy buffer.    

This is a good idea.  It would be nice to also be able to do the
traditional X-ish select and copy for the various text fields displayed 
for packet dissection, so that I could highlite a section of a field 
for the packet I'm currently looking at and paste it into a filter.

>                                                                       
> -Save window size & configuration to a prefs file.                    

This is a very good idea, and one that I suspect would be relatively easy 
to implement as you would just need to look into how prefs are handled in 
ethereal and how GTK handles windows sizing.

>                                                                       
> -The ability to delete packets in the packet list.                    
> 

I'm not sure why you would want to do this, nor am I sure that it 
is going to be easy as it seems from the little bit of poking 
around in that the capture is basically a linear sequence of packets
stored in a capture file.  You might also want to look into what editcap 
does, as my impression is it does similar things.
                                                                      
>                                                                       
>                                                                       
> Or tell me if you've got an idea for an easy fonction to do.          
> 

The classic beginning would be to write a dissector for an unsupported 
protocol if you can find a protocol that interest you that isn't
supported.
                                                                      
I hope these comments prove helpful.

Ed