Ethereal-dev: Re: [Ethereal-dev] Van Jacobson dissector.
Guy Harris wrote:
IP/TCP and up. VJ does some pretty horrific layering violations for the
sake of performance. The idea here is (more for tetherial)
Why do Ethereal and Tethereal differ here?
Umm.. one has a gui.. one doesn't.. :-) Seriously, a group here was
going to write a tool to do some post processing on the output from ethereal.
Tetherials output is easier to grab. They didn't want to have to look
at both the compressed and uncompressed frame to build the "what would this
look like if it hadn't been compressed" frame... Thats not a good enough
reason for this uglyness so..
you end up
with what looks like a ppp packet that was never compressed in the
uncompressed tab framing info and all, otherwise the uncompressed packet
tab contains only IP and up.
So presumably all you need is information from the PPP header; the PPP
dissector has no clue what information appeared *before* the PPP header,
and neither does the VJ decompressor.
Yes...
That information can be supplied using the standard Ethereal mechanism
for that, wherein the calling dissector sets "pinfo->private_data" to
point to a local data structure before calling the subdissector.
Yes...
