Wireshark · Ethereal-users: [Ethereal-users] setting output format from Ethereal structures

[Mike Wakerly <mikew@xxxxxxxxxxx>]

Greetings!

I had expected this to be a common question, but I've
looked at the past few months of archives and have not
found a solution.

I would like to know if the is a method to access the
data structures available to Ethereal whilst printing.
My specific application is that, I have a dumpfile in
tcpdump format. I'd like Ethereal to dissect all the
packets and, for NFS packets, simply print the file
handle: Eg: printf(packet->nfs.fh.fn)

My suspicion is that there is no such code in Ethereal
to do this; I understand the complexity of adding such
a general purpose feature. However, the robustness of
Ethereal and its very complete dissectors is something
I'd like to take advantage of, so I am willing to do a
bit of work to get this sort of feature out of
Ethereal. The only way I can see this being done right
now is either parsing the text output of tetheral -V
(which is expensive) or writing my own dissection
routines and not using ethereal (also expensive <grins>).

For someone more familiar with the sources than I am
(though I am getting there... there is a lot), can you
point me in the right direction? 

Cheers,
Mike Wakerly