Wireshark · Wireshark-dev: Re: [Wireshark-dev] [PATCH] Dissector hooks: Small and Simple additions

[Shehjar Tikoo <shehjart@xxxxxxxxxxxxxxx>]

Hi

Guy Harris wrote:
> On Mar 1, 2007, at 4:57 PM, Shehjar Tikoo wrote:
>
> > One drawback of a per-field hook could be that hooks which need a 
> > global view or state of the full message might not get access to 
> > the needed fields.
>
> Couldn't the private data passed to the hook be used to store the 
> kind of state needed for that?

See my previous post in reply to Sebastien's message for this.


> Also, can this be done with the existing tap mechanism, by searching
>  for particular fields in the generated protocol tree?

hmmm..it seems possible since the edt passed to the tap callback does 
contain the tvbuff and pinfo which contain most of the state required here.

Note that the NFS dissector does not have a tap, which will have to be 
added there with the starting offset of the NFS request/reply as the tap 
specific data.

I'll look more into this approach.

Regards
Shehjar