Ethereal-dev: [Ethereal-dev] Re: Patch: dissectors for the rsplib test programs

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>
Date: Wed, 31 May 2006 10:54:34 +0000
some minor comments

in the ping pong protocol dissector
can you get rid of the redundant NETWORK_BYTE_ORDER define and just
use FALSE.   These fields are always encoded the same on the wire
regardless of the endianness of the host  right?

in componentstatusprotocol,   you register it to a udp port (thats ok)
but you use an old style dissector (returning void). (our fault we
havent documented it properly)


can you look at some other dissectors and see how new-style is used?
essentially new-style dissectors return a gboolean with TRUE==this
was my protocol   i dissected it and  FALSE==i dont think this was
mine, try someone else.

Then add some simple heuristics to the start of the dissector to first
do basic sanity checking whether the protocol actually looks like it
might be this one or something else.
Ethereal supports many many protocols and it is quite common that
there are port collissions in the trace.
Doing this change will make udp traffic between say port 2960 and 88 work.
2960 mathes your protocol, 88 by random chance matches kerberos.
which one should be taken?

returning true/false allows ethereal to first try one of them   and if
it returns FALSE==not mine   ehtereal will try the other one instead.


This check has to be performed before any proto_tree_add_item()s are
called in case it has to reject the packet.

In dissect_calcappprotocol()   you encapsulate the
proto_tree_add_item()s inside an if tree is true.
This means that filtering will not work.

tree might be FALSE if ethereal is just doing filtering  and not
really dissecting the packets for the display.
Get rid of these if encapsulations.
(ethereal often use these kind of if(tree)  but only to encapsulate
the calls creating the actual
expansion/(proto_tree_add_item+proto_item_add_subtree))

so remove these encapsulations so that filtering will work for these fields.









On 5/31/06, Thomas Dreibholz <dreibh@xxxxxxxxxxxxxx> wrote:
Hi!

Attached to this mail, you find a patch adding 4 dissectors for the rsplib
Open Source RSerPool implementation's test programs (see also
http://tdrwww.iem.uni-due.de/dreibholz/rserpool/).


Best regards
--
=======================================================================
 Dipl.-Inform. Thomas Dreibholz

 University of Essen,                            Room ES210
 Inst. for Experimental Mathematics              Ellernstraße 29
 Computer Networking Technology Group            D-45326 Essen/Germany
-----------------------------------------------------------------------
 E-Mail:     dreibh@xxxxxxxxxxxxxxxxxxxxx
 Homepage:   http://www.exp-math.uni-essen.de/~dreibh
=======================================================================


_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev