Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: Ethereal Gripe

["Andrew Feren" <aferen@xxxxxxxxxxxxxxxxx>]

----- Original Message ----- 
From: "Kevin" <kem2@xxxxxxx>
To: "Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>
Cc: "Tomas Kukosa" <tomas.kukosa@xxxxxxxxxxx>; "Guy Harris"
<guy@xxxxxxxxxxxx>; "Mark H. Wood" <mwood@xxxxxxxxx>;
<ethereal-dev@xxxxxxxxxxxx>
Sent: Sunday, August 24, 2003 9:52 AM
Subject: Re: [Ethereal-dev] Re: Ethereal Gripe


> Comment from a heavy user of ethereal.  I am not a developer in any
> manner, but my team and I do use ethereal daily.
>
> Acterna Examine has / had the ability to insert a user definable
> protocol layer into the decode.  Then filters can be applied to this
> layer using the defined field names.
>
> Just the ability to break out and display these proprietary or new
> fields is a godsend.  Any relationships between the fields is
> determined by the user.

I agree.

It was the inability of the sniffer we were using to do this that drove me
to discover and begin developing ethereal dissectors.  I agree with Ronnie
that just decoding the packet doesn't make a good dissector.  However, if a
good dissector is not available the ability to break out and display
new/proprietary fields would be fabulous.  In some cases it might even be
all that is needed.

-Andrew