Wireshark · Ethereal-dev: Re: [Ethereal-dev] [PATCH] decouple dcerpc authentication from packet-dcerpc.c

[Guy Harris <guy@xxxxxxxxxxxx>]

On Tuesday, July 15, 2003, at 6:01 PM, Tim Potter wrote:

> I think making the functions of type new_dissector_t instead of
> dcerpc_dissect_fnct_t would be a better match.

Probably.  "new_dissector_t"s return a length rather than a new offset, 
but one can be transformed into the other; the only reason a 
"dcerpc_dissect_fnct_t" would be useful would be if there were an 
authentication flavor that used NDR encoding so that the "drep" 
argument was required.