Wireshark · Ethereal-dev: [Ethereal-dev] Re: [distcc] [patch] distcc dissector for ethereal

[Brad Hards <bhards@xxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 10 Mar 2003 15:01, Martin Pool wrote:
> Please call it "distcc distributed compiler", not the generic
> "Distributed Compiler System", which seems to be the name of some
> older system.
No idea where I got the name from.  Fixed.

> Perhaps you could use the word "magic" a bit less?  It's magic, but
> not that magic. :-) (Or is this special jargon for Ethereal?)
Trust me, when I was trying to figure out how it worked, it was deep magic :-)
The user should see a lot less "magic"s now. When I did the tree below, I just 
dropped out displaying of the fixed elements.

> I think the dissection could reasonably be a bit shorter, and perhaps
> also split into a tree.  Something like
>
>   distcc request
>     compilation request (version 1)
>     arguments (19): gcc-3.2 -c foo.i -o foo.o -Wall
>       argument 0: "gcc-3.2" (7 bytes)
>         ...
>     input file (71232 bytes)
I implemented a tree for requests - slightly different to the one above. Any 
comments, and also any suggestions for how it should look on the response 
side?

Also, there might be a better way to show the file contents. I'll take a look 
at that too.

> Perhaps it would be good to explain fields more in terms of what they
> mean, rather than the tags used in the protocol.  So, "input file" or
> "preprocessed source" rather than "DOTI data", "stderr messages"
> rather than "SERR", etc.  Ethereal seems to get a pretty good balance
> here with other protocols.
Good point. I've fixed some of it.

> You could decode the STAT result as a waitstatus.
This is still to come. I need to think about presentation for this.

> In the summary line packet list I think the best thing to show for the
> request is the whole compiler command line; for the response probably
> the decoded status and perhaps the error messages.
Response is a bit harder - I recall seeing packets for the response where the 
SOUT part was in a different packet to SERR. I still like the idea of 
labelling them with indicative contents.

> It's still pretty useful as it is; these suggestions are just in case
> you feel like polishing it a bit more.
I am working on it, but I have a few things that are more important (GF 
birthday on Tues, horseriding on Wed, UUNITE and ANSP meetings on Thurs :) to 
take care of before the weekend, which is when I am likely to get back it it.
An interim patch is attached - feedback welcome. Hopefully this can get 
through to distcc.

Brad
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+bH0iW6pHgIdAuOMRArkgAKC63ar45ZYfq/xMCyoioB/8nCt68QCghiTL
23Y956pcZgjqonRQCnbFNB0=
=lkW0
-----END PGP SIGNATURE-----

diff -Naur -X ethereal-dontdiff clean/ethereal-0.9.9/Makefile.am ethereal-0.9.9-distcc/Makefile.am
--- clean/ethereal-0.9.9/Makefile.am	2003-01-24 10:50:12.000000000 +1100
+++ ethereal-0.9.9-distcc/Makefile.am	2003-03-06 21:06:50.000000000 +1100
@@ -170,6 +170,7 @@
 	packet-dec-bpdu.c \
 	packet-dhcpv6.c \
 	packet-diameter.c \
+	packet-distcc.c \
 	packet-dlsw.c  \
 	packet-dns.c   \
 	packet-dsi.c   \
diff -Naur -X ethereal-dontdiff clean/ethereal-0.9.9/Makefile.nmake ethereal-0.9.9-distcc/Makefile.nmake
--- clean/ethereal-0.9.9/Makefile.nmake	2003-01-23 13:45:42.000000000 +1100
+++ ethereal-0.9.9-distcc/Makefile.nmake	2003-03-06 21:06:50.000000000 +1100
@@ -113,6 +113,7 @@
 	packet-dec-bpdu.c \
 	packet-dhcpv6.c \
 	packet-diameter.c \
+	packet-distcc.c \
 	packet-dlsw.c  \
 	packet-dns.c   \
 	packet-dsi.c   \
diff -Naur -X ethereal-dontdiff clean/ethereal-0.9.9/packet-distcc.c ethereal-0.9.9-distcc/packet-distcc.c
--- clean/ethereal-0.9.9/packet-distcc.c	1970-01-01 10:00:00.000000000 +1000
+++ ethereal-0.9.9-distcc/packet-distcc.c	2003-03-10 22:48:01.000000000 +1100
@@ -0,0 +1,532 @@
+/* packet-distcc.c
+ * Routines for distcc dissection
+ * Copyright 2003, Brad Hards <bradh@xxxxxxxxxxxxx>
+ *
+ * $Id: README.developer,v 1.65 2002/11/09 08:37:00 guy Exp $
+ *
+ * Ethereal - Network traffic analyzer
+ * By Gerald Combs <gerald@xxxxxxxxxxxx>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <string.h>
+#include <time.h>
+#include <glib.h>
+
+#include <epan/packet.h>
+#include <epan/strutil.h>
+#include <epan/conversation.h>
+
+#include "prefs.h"
+
+typedef enum _distcc_state {
+    DISTCC_DIST = 0,
+    DISTCC_ARGS = 1,
+    DISTCC_DOTI = 2,
+    DISTCC_DOTI_CONT = 3,
+    DISTCC_DONE = 4,
+    DISTCC_STAT = 5,
+    DISTCC_SERR = 6,
+    DISTCC_SOUT = 7,
+    DISTCC_DOTO = 8,
+    DISTCC_DOTO_CONT = 9
+} distcc_state_t;
+
+/* this is used to represent the _initial_ state of the frame */
+/* each frame can contain multiple protocol elements */
+struct distcc_frame_state_t {
+    distcc_state_t 	state;
+    int			done_sub_len;
+    guint		len_remaining;
+};
+
+/* this is a guide to the current conversation state */
+/* we need the length remaining because source and object elements can
+   easily span multiple frames, and we need to track the
+   internal"sub-state" in DOTI and DOTO */ 
+struct distcc_conversation_state_t {
+    distcc_state_t 	state;
+    guint		len_remaining;
+};
+
+static int proto_distcc = -1;
+
+static int hf_distcc_hdr = -1;
+static int hf_distcc_hdr_version = -1;
+static int hf_distcc_hdr_argc = -1;
+static int hf_distcc_doti_magic = -1;
+static int hf_distcc_done_version = -1;
+static int hf_distcc_stat_magic = -1;
+static int hf_distcc_stat_result = -1;
+static int hf_distcc_serr_magic = -1;
+static int hf_distcc_sout_magic = -1;
+static int hf_distcc_doto_magic = -1;
+
+static gint ett_distcc = -1;
+static gint ett_distcc_args = -1;
+
+dissector_handle_t distcc_handle;
+
+
+#define TCP_PORT_DISTCC	3632
+
+static int glb_distcc_tcp_port = TCP_PORT_DISTCC;
+
+/* Packet dissection routine called by tcp (& udp) when port 3632 detected */
+static void
+dissect_distcc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
+{
+    int 				offset = 0;
+    proto_item 				*ti, *targs;
+    proto_tree 				*distcc_tree;
+    proto_tree				*distcc_args_tree;
+    conversation_t 			*conversation;
+    struct distcc_conversation_state_t	*conversation_data;
+    struct distcc_frame_state_t		*frame_data;
+    gchar				request_ver_string[9];
+    int         			request_ver;
+    gchar				response_ver_string[9];
+    int         			response_ver;
+    gchar				cmd_line_argc_string[9];
+    int         			cmd_line_argc;
+    int					yalv = 0;
+    gchar				cmd_line_argv_len_string[9];
+    int         			cmd_line_argv_len;
+    gchar				doti_length_string[9];
+    gchar				doti_magic[9];
+    guint         			doti_length;
+    guint				actual_bytes_remaining;
+    gchar				sout_length_string[9];
+    guint				sout_length;
+    gchar				serr_length_string[9];
+    guint				serr_length;
+    gchar				doto_length_string[9];
+    guint         			doto_length;
+
+    if (check_col(pinfo->cinfo, COL_PROTOCOL))
+        col_set_str(pinfo->cinfo, COL_PROTOCOL, "DISTCC");
+
+    if (check_col(pinfo->cinfo, COL_INFO))
+        col_clear(pinfo->cinfo, COL_INFO);
+
+    conversation = find_conversation(&pinfo->src, &pinfo->dst, pinfo->ptype,
+				     pinfo->srcport, pinfo->destport, 0);
+    if (conversation == NULL) {
+	conversation = conversation_new(&pinfo->src, &pinfo->dst,
+					pinfo->ptype, pinfo->srcport,
+					pinfo->destport, 0);
+	conversation_data = malloc(sizeof(struct distcc_conversation_state_t));
+	conversation_data->state = DISTCC_DIST;
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+    }
+
+    conversation_set_dissector(conversation, distcc_handle);
+   
+    ti = proto_tree_add_item(tree, proto_distcc, tvb, 0, -1, FALSE);
+
+    distcc_tree = proto_item_add_subtree(ti, ett_distcc);
+
+    conversation_data = conversation_get_proto_data(conversation, proto_distcc);
+
+    frame_data = p_get_proto_data(pinfo->fd, proto_distcc);
+    if (!frame_data) {
+	/* then we haven't seen this frame before */
+	frame_data = malloc(sizeof(struct distcc_frame_state_t));
+	frame_data->state = conversation_data->state;
+	frame_data->len_remaining = conversation_data->len_remaining;
+	p_add_proto_data(pinfo->fd, proto_distcc, frame_data);
+    }
+
+    switch (frame_data->state) {
+    case DISTCC_DIST:
+	tvb_get_nstringz0(tvb, offset+4, 8, request_ver_string);
+	request_ver = strtoul(request_ver_string, NULL, 16);
+
+        proto_tree_add_text(distcc_tree, tvb, 0, 12,
+			    "distcc request header (Version %i)",
+			    request_ver);
+	offset += 4;
+
+	proto_tree_add_item_hidden(distcc_tree, hf_distcc_hdr_version, tvb, offset, 8, TRUE);
+	offset += 8;
+	
+	conversation_data->state = DISTCC_ARGS;
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	if (tvb_length_remaining(tvb, offset) == 0)
+	    break;
+
+    case DISTCC_ARGS:
+        targs = proto_tree_add_text(distcc_tree, tvb, offset, 12, "Arguments");
+        distcc_args_tree = proto_item_add_subtree(targs, ett_distcc);
+	offset += 4;
+
+	tvb_get_nstringz0(tvb, offset, 8, cmd_line_argc_string);
+	cmd_line_argc = strtoul(cmd_line_argc_string, NULL, 16);
+	proto_tree_add_text(distcc_args_tree, tvb, offset, 8,
+			    "Number of arguments: %i",
+			    cmd_line_argc);
+	offset +=8;
+	for (yalv = 0; yalv<cmd_line_argc; yalv++) {
+	    tvb_get_nstringz0(tvb, offset+4, 8, cmd_line_argv_len_string);
+	    cmd_line_argv_len = strtoul(cmd_line_argv_len_string, NULL, 16);
+	    proto_tree_add_text(distcc_args_tree, tvb, offset+12, cmd_line_argv_len,
+				"Argument %i: %s (%i bytes)",
+				yalv,
+				tvb_format_text(tvb, offset+12, cmd_line_argv_len),
+				cmd_line_argv_len);
+	    if (check_col(pinfo->cinfo, COL_INFO)) {
+		col_append_fstr(pinfo->cinfo,
+				COL_INFO,
+				"%s ", 
+				tvb_format_text(tvb, offset+12, cmd_line_argv_len));
+	    }
+	    offset += (12 + cmd_line_argv_len);
+	}
+	conversation_data->state = DISTCC_DOTI;
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	if (tvb_length_remaining(tvb, offset) == 0)
+	    break;
+	
+    case DISTCC_DOTI:
+	if (check_col(pinfo->cinfo, COL_INFO)) {
+	    col_append_str(pinfo->cinfo, COL_INFO, " Input file");
+	}
+	tvb_get_nstringz0(tvb, offset+4, 8, doti_length_string);
+	doti_length = strtoul(doti_length_string, NULL, 16);
+	proto_tree_add_text(distcc_tree, tvb, offset, 12,
+			    "Input file (%i bytes):",
+			    doti_length);
+	offset +=12;
+	actual_bytes_remaining = tvb_length_remaining(tvb, offset);
+	if (check_col(pinfo->cinfo, COL_INFO)) {	
+	    col_append_fstr(pinfo->cinfo, COL_INFO,
+			    " (%i of %i bytes)", actual_bytes_remaining,
+			    doti_length);
+	}
+	if (actual_bytes_remaining >= doti_length) {
+	    /* this is the case where we have all the data */
+	    proto_tree_add_text(distcc_tree, tvb, offset, doti_length,
+				"    %s",
+				tvb_format_text(tvb, offset, doti_length));
+	    offset += doti_length;
+	    conversation_data->state = DISTCC_DONE;
+	} else {
+	    /* this is where we have only the start of the data, and
+	       it continues in a later frame */
+	    proto_tree_add_text(distcc_tree, tvb, offset, actual_bytes_remaining,
+				"    %s",
+				tvb_format_text(tvb, offset, actual_bytes_remaining));
+	    offset += actual_bytes_remaining;
+	    conversation_data->state = DISTCC_DOTI_CONT;
+	    conversation_data->len_remaining = doti_length - actual_bytes_remaining;
+	}
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	/* we always need to break out at this point */
+	break;
+
+    case DISTCC_DOTI_CONT:
+	/* do a sanity check, against dropped frames */
+	tvb_get_nstringz0(tvb, offset, 8, doti_magic);
+	if (0 == strncmp(doti_magic, "DONE0000", 8)) {
+	  /*
+	    printf("failed sanity checking - bailing out to DISTCC_DONE\n");
+	  */
+	    conversation_data->state = DISTCC_DONE;
+	    conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	} else {
+	    actual_bytes_remaining = tvb_length(tvb);
+	    if (actual_bytes_remaining >= frame_data->len_remaining) {
+		/* this is the case where we have all the data */
+		if (check_col(pinfo->cinfo, COL_INFO)) {
+		    col_append_fstr(pinfo->cinfo, COL_INFO,
+				    "Input File Finalisation (%i bytes)", actual_bytes_remaining);
+		}
+		proto_tree_add_text(distcc_tree, tvb, offset,
+				    conversation_data->len_remaining,
+				    "Input file data: %s",
+				    tvb_format_text(tvb, offset,
+						    frame_data->len_remaining));
+		offset += conversation_data->len_remaining;
+		conversation_data->state = DISTCC_DONE;
+	    } else {
+		/* this is where we have only the start of the data, and
+		   it continues in a later frame */
+		if (check_col(pinfo->cinfo, COL_INFO)) {
+		    col_append_fstr(pinfo->cinfo, COL_INFO,
+				    "Input File Continuation (%i bytes)", actual_bytes_remaining);
+		}
+		proto_tree_add_text(distcc_tree, tvb, offset, actual_bytes_remaining,
+				    "Input file data: %s",
+				    tvb_format_text(tvb, offset, actual_bytes_remaining));
+		offset += actual_bytes_remaining;
+		conversation_data->state = DISTCC_DOTI_CONT;
+		/* this routine runs on display, not just on initial pass */
+		/* so we use a flag to ensure we only subtract length once */
+		if (frame_data->done_sub_len == 0) {
+		    conversation_data->len_remaining -= actual_bytes_remaining;
+		    frame_data->done_sub_len = 1;
+		    p_add_proto_data(pinfo->fd, proto_distcc, frame_data);
+		}
+	    }
+	    conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	    
+	    break;
+	} /* note that we fall through if we failed the sanity check */
+    case DISTCC_DONE:
+	if (check_col(pinfo->cinfo, COL_INFO)) {
+	    col_append_str(pinfo->cinfo, COL_INFO, "Response  ");
+	}
+	tvb_get_nstringz0(tvb, offset+4, 8, response_ver_string);
+	response_ver = strtoul(response_ver_string, NULL, 16);
+
+        proto_tree_add_text(distcc_tree, tvb, 0, 12,
+			    "distcc response header (Version %i)",
+			    response_ver);
+	offset += 4;
+
+	proto_tree_add_item_hidden(distcc_tree, hf_distcc_done_version, tvb, offset, 8, TRUE);
+	offset += 8;
+	
+	conversation_data->state = DISTCC_STAT;
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	if (tvb_length_remaining(tvb, offset) == 0)
+	    break; /* else fall through, since we have more data */
+
+    case DISTCC_STAT:
+	if (check_col(pinfo->cinfo, COL_INFO)) {
+	    col_append_str(pinfo->cinfo, COL_INFO, "Status  ");
+	}
+	proto_tree_add_item(distcc_tree, hf_distcc_stat_magic, tvb, offset, 4, TRUE);
+	offset += 4;
+	proto_tree_add_item(distcc_tree, hf_distcc_stat_result, tvb, offset, 8, TRUE);
+	offset += 8;
+
+	conversation_data->state = DISTCC_SERR;
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	if (tvb_length_remaining(tvb, offset) == 0)
+	    break;
+
+    case DISTCC_SERR:
+	if (check_col(pinfo->cinfo, COL_INFO)) {
+	    col_append_str(pinfo->cinfo, COL_INFO, "Standard Error  ");
+	}
+	proto_tree_add_item(distcc_tree, hf_distcc_serr_magic, tvb, offset, 4, TRUE);
+	offset += 4;
+	tvb_get_nstringz0(tvb, offset, 8, serr_length_string);
+	serr_length = strtoul(serr_length_string, NULL, 16);
+	proto_tree_add_text(distcc_tree, tvb, offset, 8,
+			    "SERR Length: %i (0x%x)",
+			    serr_length, serr_length);
+	offset +=8;
+	if (serr_length > 0) {
+		proto_tree_add_text(distcc_tree, tvb, offset,
+				    serr_length,
+				    "SERR: %s",
+				    tvb_format_text(tvb, offset, serr_length));
+		offset += serr_length;
+	}
+	conversation_data->state = DISTCC_SOUT;
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	if (tvb_length_remaining(tvb, offset) == 0)
+	    break;
+
+    case DISTCC_SOUT:
+	if (check_col(pinfo->cinfo, COL_INFO)) {
+	    col_append_str(pinfo->cinfo, COL_INFO, "Standard Output ");
+	}
+	proto_tree_add_item(distcc_tree, hf_distcc_sout_magic, tvb, offset, 4, TRUE);
+	offset += 4;
+	tvb_get_nstringz0(tvb, offset, 8, sout_length_string);
+	sout_length = strtoul(sout_length_string, NULL, 16);
+	proto_tree_add_text(distcc_tree, tvb, offset, 8,
+			    "Standard output length: %i (0x%x)",
+			    sout_length, sout_length);
+	offset +=8;
+	if (sout_length > 0) {
+		proto_tree_add_text(distcc_tree, tvb, offset,
+				    sout_length,
+				    "standard output: %s",
+				    tvb_format_text(tvb, offset, sout_length));
+		offset += sout_length;
+	}
+	conversation_data->state = DISTCC_DOTO;
+	conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	if (tvb_length_remaining(tvb, offset) == 0)
+	    break;
+
+    case DISTCC_DOTO:
+	if (check_col(pinfo->cinfo, COL_INFO)) {
+	    col_append_str(pinfo->cinfo, COL_INFO, "Output File  ");
+	}
+	proto_tree_add_item(distcc_tree, hf_distcc_doto_magic, tvb, offset, 4, TRUE);
+	offset += 4;
+	tvb_get_nstringz0(tvb, offset, 8, doto_length_string);
+	doto_length = strtoul(doto_length_string, NULL, 16);
+	proto_tree_add_text(distcc_tree, tvb, offset, 8,
+			    "DOTO Length: %i (0x%x)",
+			    doto_length, doto_length);
+	offset +=8;
+	actual_bytes_remaining = tvb_length_remaining(tvb, offset);
+	proto_tree_add_text(distcc_tree, tvb, offset, 0,
+			    "Bytes in this packet: %i (0x%x)",
+			    actual_bytes_remaining, actual_bytes_remaining);
+	if (check_col(pinfo->cinfo, COL_INFO)) {
+	    col_append_fstr(pinfo->cinfo, COL_INFO, "(%i of %i bytes)",
+			    actual_bytes_remaining, doto_length);
+	}
+
+	if (actual_bytes_remaining >= doto_length) {
+	    /* this is the case where we have all the data */
+	    proto_tree_add_text(distcc_tree, tvb, offset, doto_length,
+				"DOTO data: %s",
+				tvb_format_text(tvb, offset, doto_length));
+	    offset += doto_length;
+	} else {
+	    /* this is where we have only the start of the data, and
+	       it continues in a later frame */
+	    proto_tree_add_text(distcc_tree, tvb, offset, actual_bytes_remaining,
+				"DOTO data: %s",
+				tvb_format_text(tvb, offset, actual_bytes_remaining));
+	    offset += actual_bytes_remaining;
+	    conversation_data->state = DISTCC_DOTO_CONT;
+	    conversation_data->len_remaining = doto_length - actual_bytes_remaining;
+	    conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	}
+	/* we always need to break out at this point */
+	break;
+
+    case DISTCC_DOTO_CONT:
+	actual_bytes_remaining = tvb_length(tvb);
+	if (actual_bytes_remaining >= frame_data->len_remaining) {
+	    /* this is the case where we have all the data */
+	    if (check_col(pinfo->cinfo, COL_INFO)) {
+		col_append_fstr(pinfo->cinfo, COL_INFO,
+				"DOTO Finalisation (%i bytes)", actual_bytes_remaining);
+	    }
+	    proto_tree_add_text(distcc_tree, tvb, offset,
+				frame_data->len_remaining,
+				"DOTO data: ...%s",
+				tvb_format_text(tvb, offset,
+						frame_data->len_remaining));
+	    offset += frame_data->len_remaining;
+	} else {
+	    /* this is where we have only some of the data, and
+	       it continues in a later frame */
+	    if (check_col(pinfo->cinfo, COL_INFO)) {
+		col_append_fstr(pinfo->cinfo, COL_INFO,
+				"DOTO Continuation (%i bytes)", actual_bytes_remaining);
+	    }
+	    proto_tree_add_text(distcc_tree, tvb, offset, actual_bytes_remaining,
+				"DOTO data: ...%s...",
+				tvb_format_text(tvb, offset, actual_bytes_remaining));
+	    offset += actual_bytes_remaining;
+	    conversation_data->state = DISTCC_DOTO_CONT;
+	    /* this routine runs on display, not just on initial pass */
+	    /* so we use a flag to ensure we only subtract length once */
+	    /* we will never get DOTI and DOTO in the same frame, since 
+	       they go in opposing directions, so we can reuse the flag */
+	    if (frame_data->done_sub_len == 0) {
+		conversation_data->len_remaining -= actual_bytes_remaining;
+		frame_data->done_sub_len = 1;
+		p_add_proto_data(pinfo->fd, proto_distcc, frame_data);
+	    }
+	    conversation_add_proto_data(conversation, proto_distcc, conversation_data);
+	}
+	    
+	break;
+    }
+}
+
+/* Register protocol with Ethereal. */
+void
+proto_register_distcc(void)
+{
+    static hf_register_info hf[] = {
+	{&hf_distcc_hdr,
+	 {"Request Header", "distcc.request_header",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }
+	},
+	{&hf_distcc_hdr_version,
+	 {"Request Version", "distcc.request_version",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "DISTCC Version", HFILL }
+	},
+	{&hf_distcc_hdr_argc,
+	 {"argc", "distcc.hdr_argc",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "Number of arguments", HFILL }
+	},
+	{&hf_distcc_doti_magic,
+	 {"input file header", "distcc.input_header",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }
+	},
+	{&hf_distcc_done_version,
+	 {"Response Version", "distcc.resposne_version",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "DISTCC Daemon Version", HFILL }
+	},
+	{&hf_distcc_stat_result,
+	 {"Reponse status value", "distcc.stat_result",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }
+	},
+	{&hf_distcc_doto_magic,
+	 {"output file header", "distcc.output_header",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }
+	},
+	{&hf_distcc_stat_magic,
+	 {"Response status header", "distcc.stat_header",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }
+	},
+	{&hf_distcc_serr_magic,
+	 {"Standard error header", "distcc.serr_header",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }
+	},
+	{&hf_distcc_sout_magic,
+	 {"Standard output header", "distcc.sout_header",
+	  FT_STRING, BASE_NONE, NULL, 0x0, "", HFILL }
+	},
+    };
+
+    static gint *ett[] = {
+	&ett_distcc,
+	&ett_distcc_args,
+    };
+
+    module_t *distcc_module;
+
+    proto_distcc = proto_register_protocol("distcc distributed compiler",
+					   "DISTCC", "distcc");
+    proto_register_field_array(proto_distcc, hf, array_length(hf));
+    proto_register_subtree_array(ett, array_length(ett));
+
+    distcc_module = prefs_register_protocol(proto_distcc, NULL);
+    prefs_register_uint_preference(distcc_module, "tcp.port",
+				   "DISTCC TCP Port",
+				   "Set the TCP port for DISTCC messages",
+				   10,
+				   &glb_distcc_tcp_port);
+}
+void
+proto_reg_handoff_distcc(void)
+{
+    distcc_handle = create_dissector_handle(dissect_distcc, proto_distcc);
+    dissector_add("tcp.port", glb_distcc_tcp_port, distcc_handle);
+}