Ethereal-dev: Re: [Ethereal-dev] RTP Analysis: Need help withredissect_packetsimplementation d
OK.
I understand.
Well I dont really know whether we need the proto tree or not for taps in
all situations.
The taps only really need two things:
1, the dissector must be called so it can call tap_queue_packet() so the
tap can pick it up in the _packet() function.
2, IF the tap use a filter, then we must dissect all packets so we can
evaluate the filter string.
Please have a go and see if you can come up with an improvement, thats what
open source is for.
I ALWAYS use colorfilters or rather one colorfilter : "tcp.analysis.flags"
so I wont benefit from any
speedups anyway.
----- Original Message -----
From: "Lars Ruoff"
Sent: Friday, November 21, 2003 9:40 PM
Subject: Re: [Ethereal-dev] RTP Analysis: Need help
withredissect_packetsimplementation details
>
> ----- Original Message -----
> From: "Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>
> To: "Lars Ruoff" <lars.ruoff@xxxxxxxxxxxxxxxxxx>; "Ethereal-Dev"
> <Ethereal-dev@xxxxxxxxxxxx>
> Sent: Friday, November 21, 2003 10:49 AM
> Subject: Re: [Ethereal-dev] RTP Analysis: Need help with
> redissect_packetsimplementation details
>
>
> > Hi, sorry that you guys lost in the semifinals, the others had a
really
> > boring style of play. I really thought you guys and the kiwis would
> > be in the final.
>
> You're talking about the French rugby team?
> Well, that i'm working in France doesnt mean i'm French ;-)
> I dont understand anything about rugby. I prefer soccer.
> (I'm from the nation which's soccer team is world champion. Well..., the
> *female* team that is) :-)
>
>
> > If your tap wants the _packet() function to be called, the pacekts must
> be
> > completely dissected again.
>
> Agreed.
>
> > No, but we MUST redissect the packets if there are color filters
defined.
> > We also MUST redissect the packets if there are tap listeners
registered.
> > Taps and ColorFilters do not interact but they have in common that both
of
> > them need a full packet redissection.
>
> Yes, but after what i thought, tap listeners dont necessarily need the
proto
> tree being built, so why *always* building the proto tree, even if its
only
> a tap listener that requested the redissection?
> Shouldnt there be some option to redissect_packets that says "dont care
> about the proto tree in this run"
> That's all what my point is about.
>
> Lars Ruoff
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
