Wireshark · Wireshark-dev: Re: [Wireshark-dev] how to get UDP payload from the UDP tap

["ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>]

It would be a much better approach to finish a proper MPEG2 dissector
instead and make it tappable than pass the actual payload to the tap.

The decoding of payload types belong to the dissectors.  Taps and
statistics functions should only access already parsed and cooked
structures and fields that are prepared by the actual dissector.


Maybe Erwin and you can work together to finish the dissector?



On 8/25/06, Miha Jemec <m.jemec@xxxxxxxxxxx> wrote:
> I want to extend the Statistics->Multicast streams analysis with the
> feature which checks MPEG2 frame drops. Since MPEG2 is not yet supported
> (as I saw in today's mails it will be soon, thanks Erwin) I have to work
> with the UDP packets and therefore I need UDP payload.
>
>
> On Thu, 2006-08-24 at 17:12 -0700, Guy Harris wrote:
> > On Aug 24, 2006, at 3:51 PM, ronnie sahlberg wrote:
> >
> > > the taps do not provide access to the actual payload
> >
> > What would a UDP tap do with the payload?  Is this for something such
> > as "Follow TCP Stream"?
> >
> > (It would be inappropriate for a UDP tap to try to interpret the
> > payload as a particular type of packet - the dissector for that type
> > of packet should have a tap and a tap that only wants to process that
> > type of packet should use *that* tap.)
> > _______________________________________________
> > Wireshark-dev mailing list
> > Wireshark-dev@xxxxxxxxxxxxx
> > http://www.wireshark.org/mailman/listinfo/wireshark-dev
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev