Ethereal-dev: Re: [Ethereal-dev] more options for decode as...
Yes, that's exactly what what i need for my purposes!
(Perhaps the term "conversation" is badly choosen in this context (since it
assumes two-way communication in some sense) and we should just call it
"stream" or something like that.)
A quick workaround would be to define the direction in the user-data that
can be attached to the conversation.
You'll have to match the conversation first, then continue with checking
wether the packet's source is address1 or address2 of the conversation,
according to a flag in user-data.
----- Original Message -----
From: "Tomas Kukosa" <tomas.kukosa@xxxxxxxxxxx>
To: "Lars Ruoff" <lars.ruoff@xxxxxxxxxxxxxxxxxx>
Cc: "Ethereal-Dev" <Ethereal-dev@xxxxxxxxxxxx>
Sent: Wednesday, May 28, 2003 9:10 AM
Subject: Re: [Ethereal-dev] more options for decode as...
> Lars Ruoff wrote:
> >
> > but isn't this very limited?
> > Wouldn't it be nicer to have the possibility to assign user decodes to
> > conversations, i.e.
> > "Decode all UDP traffic from IP:port to IP:port as XXX" ?
> > (preferably with a checkbox "Both directions: yes/no")
> > The actual form could be included as a special case with wildcards being
> > used for the IP adresses.
> >
>
> Has anybody thought about "unidirectional" conversations?
> Example1:
> to be able to make two UDP conversations: IP1:port1->IP2:port2 and
> IP2:port2->IP1:port1.
> Example2:
> to make two UDP conversations: *:*->IP1:port1 and *:*->IP2:port2 and
> than each direction of IP1:port1<->IP2:port2 traffic is passed to
> different conversation.
>
> How to do it flexible and compatible with current implementation of
> conversations?
> Could it be following?
>
> /* conversation_new() options */
> #define NO_ADDR2 0x01
> #define NO_PORT2 0x02
> #define UNIDIR_ADDR1_SRC 0x04 /* unidirectional and addr1 is source
> address */
> #define UNIDIR_ADDR1_DST 0x08 /* unidirectional and addr1 is
> destination address */
>
> /* find_conversation() options */
> #define NO_ADDR_B 0x01
> #define NO_PORT_B 0x02
> #define ADDR_A_SRC 0x04 /* addr_a is source address */
> #define ADDR_A_DST 0x08 /* addr_a is destination address */
>
> Regards,
> Tom