Ethereal-dev: Re: [Ethereal-dev] Tethereal and dfilter expression ...
Guy Harris wrote:
>One could, instead, use the same mechanism that the "Decode As" menu
>item uses, letting the user specify that a particular value in a
>particular "dissector table" refer to a particular protocol, so that one
>might do
>
> tethereal -Z tcp.port:81=http
>
>or something such as that, specifying that a value of 81 in the
>"tcp.port" dissector table should be interpreted as HTTP. ("tcp.port"
>here does *NOT* refer to the "tcp.port" field; dissector tables often
>have a name that's the same as a field, but not all of them do, and most
>fields are *NOT* associated with dissector tables.).
Another way to solve this (but then only for HTTP) could be to add a protocol preference to the HTTP dissector that indicates what additional tcp port numbers should be registered (e.g. a string with zero, one or several port numbers, e.g. http.extra_tcp_ports "591,3106,81,2693,3106,6788,6842") and make the HTTP dissector parse the string and
register those ports.
http://www.ethereal.com/lists/ethereal-users/200210/msg00222.html
With tethereal the -o option could be then be used to temporarily override the value defined in the preference file.
However maybe it would be even better to change Ethereal so that "Decode As..." settings can be saved to a preference file (or manually edit the file when using Tethereal), and that Ethereal/Tethereal would read these settings at startup. I think that this issue has been brought up before on the list.
A "-Z" option could maybe be useful as a complement for temporar settings.
Maybe there should be a checkbox for each "Decode As.." entry telling if that specific entry should be saved or not. Sometimes I have some "Decode As..." settings that I would like to be more or less permanent and some that are just temporar.
I have not thought about the details so much and I will probably not have so much time to do anything about this in the near future, but it's somewhere on my wish-list/to-do-list.
Regards,
Martin
