ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] p2p_dir, gsm_sms, and promiscious capturing

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Tue, 10 Aug 2004 09:44:28 -0400

Guy Harris wrote:

On Tue, Aug 10, 2004 at 06:17:10PM +1200, Bruce Fitzsimons wrote:

I'd agree it perverts the nature of the flag. Its a relatively safe hack though, in that I assume it only affects the subsequent layers for decoding?


It's safe, assuming that, once it's been set, no lower-level dissector
does anything with that flag after control is returned to it.

Passing it forward through private_data is probably cleaner (and makes
it clearer that the direction can be trusted to be known - using the
p2p_dir flag doesn't make that clear, as that flag is, in general, *not*
guaranteed to either be P2P_DIR_RECV or P2P_DIR_SENT).

Note that the SCCP dissector (though not the SUA dissector) has a preference which allows it to set the P2P direction as well (based on a preferenced "source point code". I'm not sure if the GSM dissectors rely on this at all or not, but if you're using SUA instead of SCCP you may see different (then intended) behavior.