(Please don't send messages by following up to unrelated messages - that
causes mail readers that do threading to include the message in the
thread with the unrelated messages.)
Helge Kruse wrote:
In a stream dissector I have a query response scheme. The client sends a
query, containing an identificator. The server answers with a response that
has this identificator.
To dissect this protocol I need the query at a response time. I can build a
collection with all queries in the dissector. But this seems to be a bad
design. I would have to store ca. 50% of the data in a copy at the
dissector.
So you need about half the data from the query to dissect the response
(e.g., a query contains a key and a list of identifiers for values, and
the response contains the values corresponding to those identifiers for
the record corresponding to the key)?
So I want to remember the position in the "stream" where the query is sent.
When I dissect the response, I want to lookup the tvbuff containing the
query.
Is there any concept for this task?
Is there any concept of "look up the tvbuff containing the query"? No.
Tvbuffs don't persist after Ethereal or Tethereal finishes with a
packet. (If they did, you'd be storing *100%* of the data from the
query, *and* all the protocol headers before that data.)
There's also no notion of reading data for an earlier packet "on demand"
- with the current implementation of reading compressed capture files,
that would work *very* badly, as moving backwards in the capture file is
done by going to the beginning and reading forward. We should fix that
at some point.
Another question regards the user interface. Can I add to the context menu a
"goto query" or "goto response" item, that would navigate to that frame?
You can add to the protocol tree an item of type FT_FRAMENUM and a value
equal to the frame number of the matching query/response. (You
obviously can't do that for the response frame on the first pass through
the capture, but you could do that when the packet is selected and
re-dissected, as long as you have a data structure that remembers those
frame numbers.)
There already exist context menu items that, when you're over an
FT_FRAMENUM field, will take you to the frame in question.
