Wireshark · Ethereal-dev: Re: [Ethereal-dev] Print as XML - Status of work?

[Carsten Buchenau <carsten@xxxxxxxxxxxx>]

Fulvio Risso wrote:

> > > Attached is a sample PDML file from tethereal.
> > >      
> > I would have thought the <proto> tags should nest. If they dont, 
> > isn't there 
> > an ambiguity between:
> >
> >   <proto>
> >   </proto>
> >   <proto>
> >  </proto>
> >
> > and
> >
> >   <proto>
> >      <proto>
> >      </proto>
> >   </proto>
> >    
>
> In my view, only the first syntax sould be allowed.
> For instance, in real world protocols are nested (Ethernet includes IP that includes TCP...).
> However, when you display such a packet on the screen, you should display it as:
>
>    ethernet
>       field1
>       field2
>       ....
>    IP
>       field1
>       ....
>
> So, it is much easier not to have nested <proto> tags, since this is not what you want in the output.
> This is how PDML has been defined so far.
> Just my idea, obviously.
>  

I agree on that - the structure of different [t]ethereal output formats 
should be the same. So <proto> tags should *not* be nested, while it 
makes sence for the <field> tags. As you do in PDML.

Examining the sample output as provided by Gilbert, it is compliant to 
that spec. except for the <proto name="data" ...> tag at the bottom as 
it is nested within <proto name="http" ...>. Shouldn't the data be a 
<field> tag within the html proto-tag, as it is part of the http 
protocol? So, in my opinion, it should look like this:

 <proto name="http" size="644" pos="54">
   ...
   <*field* name="*http.*data" showname="Data (238 bytes)" size="238" pos="460" value="3c686..."/>
 </proto>

Or am I missing a point here??

Gilbert, do you mind making the code available somehow? So I could take 
a closer look at it as well... I have allocated some time for working on 
the XML output anyway already ;-)

carsten