Wireshark · Ethereal-dev: Re: [Ethereal-dev] more options for decode as...

[Tomas Kukosa <tomas.kukosa@xxxxxxxxxxx>]

Lars Ruoff wrote:
> 
> but isn't this very limited?
> Wouldn't it be nicer to have the possibility to assign user decodes to
> conversations, i.e.
> "Decode all UDP traffic from IP:port to IP:port as XXX" ?
> (preferably with a checkbox "Both directions: yes/no")
> The actual form could be included as a special case with wildcards being
> used for the IP adresses.
> 

Has anybody thought about "unidirectional" conversations?
Example1:
 to be able to make two UDP conversations: IP1:port1->IP2:port2 and
IP2:port2->IP1:port1.
Example2:
 to make two UDP conversations: *:*->IP1:port1 and *:*->IP2:port2 and
than each direction of IP1:port1<->IP2:port2 traffic is passed to
different conversation.

How to do it flexible and compatible with current implementation of
conversations?
Could it be following?

/* conversation_new() options */
#define NO_ADDR2 0x01
#define NO_PORT2 0x02
#define UNIDIR_ADDR1_SRC 0x04  /* unidirectional and addr1 is source
address */
#define UNIDIR_ADDR1_DST 0x08  /* unidirectional and addr1 is
destination address */

/* find_conversation() options */
#define NO_ADDR_B 0x01
#define NO_PORT_B 0x02
#define ADDR_A_SRC 0x04  /* addr_a is source address */
#define ADDR_A_DST 0x08  /* addr_a is destination address */

  Regards,
    Tom