Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] Need help with protocol that spans multiple TVBs

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Herbert Falk" <herb@xxxxxxxxxxxx>
Date: Tue, 13 Apr 2004 08:02:22 -0400
Although I believe that this works for ACSE, the issue is what happens after the connection is established. In the case of MMS it goes directly to PDATA. At which point only IDs are available (not Object IDs).

It gets a bit tricky, but I will look at the 10.3 presentation dissector and see what might be done.


Tomas Kukosa wrote:

Sid Sid wrote:

Yes, although, ideally, the ACSE dissector should perhaps have a
string-based dissector table for the OID of the protocol using ACSE, so
that dissectors for those protocols can just register in the dissector
table, rather than having the ACSE dissector have a hard-wired
association of OIDs with dissectors.


Good idea.
What is the best way to do it ?
I mean should we have some registration function inside ACSE dissector which will be called by FTAM/CMIP/MMS and so on dissectors ?


See packet-h225 or packet-h245 for example. Short hint is below.

--- ACSE dissector ---
/* Subdissector tables */
static dissector_table_t application_dissector_table;

show_request_sequence_top() {
...
app_handle = dissector_get_string_handle(application_dissector_table, oid_string);
...
}

proto_register_acse() {
...
application_dissector_table = register_dissector_table("acse.application", "???", FT_STRING, BASE_NONE);
...
}

--- FTAM dissector ---
proto_reg_handoff_ftam() {
...
  dissector_add_string("acse.application", "1.0.8571.1.1", ftam_handle);
...
}

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev



--
Herbert Falk
SISCO
6605 19-1/2 Mile Road
Sterling Heights, MI 48314
Ph: 586-254-0020
Fx:  586-254-0053

NOTICE: This communication may contain privileged or other confidential
information. If you are not the intended recipient, or believe that you
have  received this communication in error, please do not print, copy,
retransmit,  disseminate, or otherwise use the information. Also, please indicate to
the sender that you have received this communication in error, and delete the
copy you received. Thank you.