Guy Harris wrote:
Currently, you can't. There is currently no mechanism in Ethereal to
support more than one conversation with the same endpoint addresses and
port numbers; such a mechanism would have to be added.
Do we have a way to tell user other than 'col_add_fstr'. In afp sometime
I can detect when it clashs (cf patch below).
Such a mechanism would have to somehow arrange that more than one
conversation with the same endpoint addresses and port numbers exist,
and that the conversations be distinguished by something such as ranges
of frame numbers, so that a query searching for a conversation would
also take a frame number as an argument, and only a conversation whose
range of frame numbers includes that frame would be found. The frame
number argument would probably be the frame number of the frame being
dissected.
In addition, the TCP dissector would have to "close" a conversation
either when it detects that a TCP connection has ended or that a new
connection has started.
With relative_seq most of it is already there. Doesn't ethereal read the
whole file sequentially at least once?
Didier
Index: packet-afp.c
===================================================================
RCS file: /cvsroot/ethereal/packet-afp.c,v
retrieving revision 1.22
diff -u -B -r1.22 packet-afp.c
--- packet-afp.c 2002/09/18 01:10:02 1.22
+++ packet-afp.c 2002/09/18 08:50:06
@@ -2800,7 +2804,22 @@
afp_tree = proto_item_add_subtree(ti, ett_afp);
}
if (!aspinfo->reply) {
+
proto_tree_add_uint(afp_tree, hf_afp_command, tvb,offset, 1, afp_command);
+ if (afp_command != tvb_get_guint8(tvb, offset))
+ {
+ /* we have the same conversation for different connections eg:
+ * ip1:2048 --> ip2:548
+ * ip1:2048 --> ip2:548 <RST>
+ * ....
+ * ip1:2048 --> ip2:548 <SYN> use the same port but it's a new session!
+ */
+ if (check_col(pinfo->cinfo, COL_INFO)) {
+ col_add_fstr(pinfo->cinfo, COL_INFO,
+ "[Error!IP port reused, you need to split the capture file]");
+ return;
+ }
+ }
offset++;
switch(afp_command) {
case AFP_BYTELOCK:
