I am playing with ethereal on an in-house legacy protocol.
For this protocol (outer), the data field (outer.data) can contain
0 to several primitives of an encapsulated protocol (inner).
I.e., the outer frame can be smth like
outer {
outer.field1
outer.filed2
...
outer.data {
inner {
inner.field1
...
}
inner {
inner.field1
...
}
}
}
An alternative for the outer.data is to contain smth else, describing
outer's options.
The protocol is stupid enough so that there is no field in the outer{} frame
telling how many inner{} frames are embedded.
Right now I have inner declared as FT_NONE. When I add it to outer.data,
the filter outer.inner can only be used as a boolean (i.e. is any inner
message
embedded in the frame or not).
Suppose I want to select just thouse frames which contain more than 1
inner frame. I would like to use 'inner' as a counter - so that (inner > 1)
would select me what I want. Do you think it is a conceptually wrong
idea if I try to make a patch for ethereal to "upgrade" the boolean here
(does a label appear?) to an unsigned integer (how many times does it
appear?)?
This would uniformly cover many protos with multiple primitives per message,
giving them additional filter capability.
Right now, AFAIU, I must create a hidden field which is the counter
if I want that filter for my particular protocol - which I am going to call
outer.inner - to be
incremented each time the outer.data dissector subroutine calls
a sub-dissector for yet another inner frame.
Vassilii
