Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] New packet module, Nominum CC

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 6 Mar 2003 18:24:17 -0800
On Thu, Mar 06, 2003 at 05:58:47PM -0800, Michael Sawyer wrote:
> I have completed a decoder for the Nominum Command Channel (which is the 
> command channel used by Bind 9, as well as other Nominum products).  I have 
> it completed as a patch file to Ethereal 0.9.9, and would like to submit it 
> to the main code tree.
> 
> What's the best way to get the file off to the folks who maintain the CVS 
> tree?  If anyone wants to inspect the patch, as it is now, it's on 
> http://www.chameleon.net/mws/ethereal.patch.

Well, I've downloaded it.

Some comments:

	1) Don't patch Makefile.in or register.c - those are generated
	   files.  Patch Makefile.am instead - and patch Makefile.nmake, as
	   well.  (Change the DISSECTOR_SRC list in both files.)

	2) In "dissect_list()", it doesn't handle the case where
	   "object_type" is neither 1, 2, nor 3.  Perhaps that shouldn't
	   happen, but it could happen, due to a buggy program, or a
	   corrupted packet, or some port 9999 traffic that *isn't*
	   Nominum Command Channel traffic.

	   It should probably use "proto_tree_add_text()" to add an item
	   that says "bogus object type" and gives the type value, or
	   something such as that.

	3) All the cases in that first switch statement should perhaps
	   use offset+pos as the offset and object_size as the size.

	   The ones for 2 and 3 use 0 and -1, meaning they'll cover the
	   entire packet; do those really appear only at the *very*
	   beginning of the packet, and run all the way to the end?

	   Also, does object_size include the type or not?  The later
	   code for type 1 uses offset+pos and object_size as the
	   starting offset and length, suggesting that it does.