Wireshark · Ethereal-dev: Re: [Ethereal-dev] Registering filter fields during dissection time

[Fabrizio Bertocci <fabrizio@xxxxxxx>]

Senthil,
Probably I'm not the best person to answer this, but from my personal 
experience the answer is NO.
The dissection routine is called several time, by registering several 
times the field, you end up exhausting the memory pretty quick. The 
registration phase need to be done only once.
I think what you should do is to register all the possible fields that 
can appear in your protocol, then the dissector routine will fill up 
only the one that will find in the dissected packet.
I've worked on the RTPS packet dissector and the RTPS packet doesn't 
have all the fields registered, dynamically the dissector understand the 
content and create the protocol tree. Not all the leaves are filled up.

Fabrizio


Senthil Sundaram wrote:

> Hi,
>
> Is it possible to register filter fields from within your dissection 
> routine?
>
> i.e proto_register_field_array() - can this be called from the 
> dissection routines? Reason being, I dont know all the fields during 
> the protocol registration time. I know most of the fields for my 
> protocol during dissection time only. The payload for my protocol is 
> in the form of type-length-value form, so the fields are discovered 
> during dissection.
>
> This means the display filters have to be refreshed after the 
> dissection is complete
>
> Is this possible?
>
> Thanks
> Senthil
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev