Wireshark · Wireshark-dev: Re: [Wireshark-dev] questions about conversations

[Stephen Fisher <stephentfisher@xxxxxxxxx>]

On Wed, May 16, 2007 at 03:48:36PM -0700, Guy Harris wrote:

> Perhaps we need to have the key for the protocol data routines be a 
> frame number and an offset within the frame, so that there can be 
> multiple protocol data items within a link-layer frame.

The code that handles this is in epan/frame_data.c.  It is indexed by 
the int proto variable that is passed to p_[add|get|remove]_proto_data() 
functions (which is obtained by the dissector registering itself with 
proto_register_protocol()).  An SList is used to store the frame's pfd 
(per frame data) to keep each protocol's data separate.

It looks fairly straight-forward to add an additional "index" to this 
data structure.  We would then compare it using the custom compare 
function p_compare() that currently only compares the proto number.  
This additional value could be an int variable and let the user of the 
function choose between numbering them sequentially from 0 or 1 or using 
the offset within the packet.  This would require duplicating the 
p_[add|get|remove]_proto_data() functions so that this extra parameter 
could be passed to them.  Perhaps p_[add|get|remove]_proto_data_id() 
would be a good choice of a name.

What are other's thoughts on this?


Steve