Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: RE: [Ethereal-dev] Add PDML output to ethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Fulvio Risso" <fulvio.risso@xxxxxxxxx>
Date: Sat, 17 Apr 2004 08:40:41 +0200

> -----Original Message-----
> From: Biot Olivier [mailto:Olivier.Biot@xxxxxxxxxxx]
> Sent: venerdì 16 aprile 2004 10.52
> To: Ethereal-Dev (ethereal-dev@xxxxxxxxxxxx)
> Cc: 'Fulvio Risso'
> Subject: RE: [Ethereal-dev] Add PDML output to ethereal
>
>
> |From: Gilbert Ramirez
> |
> |On Thursday 15 April 2004 10:54, Biot Olivier wrote:
> |> Hi list,
> |>
> |> Today we can only produce PDML output in tethereal (with the -Tpdml
> |> command-line option). I guess it is not that complicated to
> |add support for
> |> PDML output in Ethereal, unless I ignore the consequences of packet
> |> reassembly?
> |>
> |
> |No, it would not be difficult. SInce PDML output is
> |implemented as a print
> |output style, the easiest and most straight-forward approach
> |would be to add
> |this option to the print dialogue.
> |
> |However, I wonder if that's not the best UI decision... do
> |users expect PDML
> |output to be selected from "File | Save As" ? Of course, they
> |serve different
> |purposes... saving as a different file format saves just the
> |packet data, not
> |the dissection, whereas the printing function prints the
> |packet dissection.
>
> I only have one question on the now available PDML output in Ethereal (not
> tethereal): the offsets and lengths of the displayed protocol fields won't
> make much sense in a *reassembled* packet. Do we need to deal with this in
> some way?
>
> Fulvio, what's your position/opinion on this?

Personally, I consider a reassembled packet such a new, "virtual" packet.
So, I believe offsets and lengths should be consistent within it.
For instance, if a packet has a 10KB HTTP payload, I believe the length of
the HTTP protocol should be 10000.

Cheers,

	fulvio