Ethereal-dev: Re: [Ethereal-dev] nfs : patch to snoop fhandle to filenames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 12 Jan 2002 02:28:24 -0800
On Sat, Jan 12, 2002 at 11:02:55AM +1100, Ronnie Sahlberg wrote:
> attached is a new patch for nfs name snooping, it fixes the bug where the
> '/'
> separating path components were sometimes missing.

Checked in (with fixes to the preference names).

Does this include all the previous name snooping patches you've sent?

> it also adds a simple 32 bit xor hash value for every fh.
> using this hash makes it 'easier' to filter for specific fhandles.

Sun's snoop generates a 16-bit hash; unfortunately, from personal
experience, I can testify that their hashing mechanism is not good
enough to avoid collisions in real life captures, which is a nuisance.

They use the 16-bit hash in summary lines; we might want to think about
having ONC RPC protocols put more into the summary line than just the
version numbe, procedure name, call/reply indicator, and XID (i.e., have
subdissectors put some of the arguments and reply parameters into the
summary).