Wireshark · Ethereal-dev: [ethereal-dev] idea for a 'standard' way of handling unknown data

["Neulinger, Nathan R." <nneul@xxxxxxx>]

It would be nice if we could distinguish between the use of dissect_data to
actually dissect data, and the use of it to handle an unknown portion of a
packet.

What I would love to be able to do (for development purposes) is do a filter
of "unknown" and have it filter out all the packets that are deemed to be
fully and correctly decoded. 

It could be done by having a dissect_unknown() routine, or always adding a
proto_tree item for "unknown". This would allow someone to quickly see what
needs work. Things like unknown subprotocols, unknown ipx sockets (outside
the dynamic ranges of course), etc. Just a thought.

-- Nathan

------------------------------------------------------------
Nathan Neulinger                       EMail:  nneul@xxxxxxx
University of Missouri - Rolla         Phone: (573) 341-4841
Computing Services                       Fax: (573) 341-4216