Ethereal-dev: Re: [Ethereal-dev] Need help with protocol that spans multiple TVBs
Although I believe that this works for ACSE, the issue is what happens
after the connection is established. In the case of MMS it goes
directly to PDATA. At which point only IDs are available (not Object IDs).
It gets a bit tricky, but I will look at the 10.3 presentation dissector
and see what might be done.
Tomas Kukosa wrote:
Sid Sid wrote:
Yes, although, ideally, the ACSE dissector should perhaps have a
string-based dissector table for the OID of the protocol using ACSE, so
that dissectors for those protocols can just register in the dissector
table, rather than having the ACSE dissector have a hard-wired
association of OIDs with dissectors.
Good idea.
What is the best way to do it ?
I mean should we have some registration function inside ACSE
dissector which will be called by FTAM/CMIP/MMS and so on dissectors ?
See packet-h225 or packet-h245 for example. Short hint is below.
--- ACSE dissector ---
/* Subdissector tables */
static dissector_table_t application_dissector_table;
show_request_sequence_top() {
...
app_handle =
dissector_get_string_handle(application_dissector_table, oid_string);
...
}
proto_register_acse() {
...
application_dissector_table =
register_dissector_table("acse.application", "???", FT_STRING,
BASE_NONE);
...
}
--- FTAM dissector ---
proto_reg_handoff_ftam() {
...
dissector_add_string("acse.application", "1.0.8571.1.1", ftam_handle);
...
}
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
--
Herbert Falk
SISCO
6605 19-1/2 Mile Road
Sterling Heights, MI 48314
Ph: 586-254-0020
Fx: 586-254-0053
NOTICE: This communication may contain privileged or other confidential
information. If you are not the intended recipient, or believe that you
have received this communication in error, please do not print, copy,
retransmit, disseminate, or otherwise use the information. Also, please indicate to
the sender that you have received this communication in error, and delete the
copy you received. Thank you.
