[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wireshark-dev
Subject:    Re: [Wireshark-dev] best practice questions - a tn3270 dissector
From:       Jeff Morriss <jeff.morriss.ws () gmail ! com>
Date:       2009-02-27 15:27:13
Message-ID: 49A80651.6060104 () gmail ! com
[Download RAW message or body]



Robert Hogan wrote:
> I'm most of the way (I hope) through a tn3270 dissector. However I'm not 
> sure of the most acceptable way of doing a couple of things:
> 
> - Should I just make TN3270 a sub-dissector of telnet? So users 
> select 'decode as telnet' and get the tn3270 dissected implicitly? Or 
> should it have a separate 'decode as' entry? If the latter, I'm not sure 
> how I can call telnet as a 'super-dissector' or alternatively, avoid 
> duplicating code.

Well, TN3270 is really 3270-over-telnet so I'd think the former was better.

> - The best way of recognizing a tn3270 session is through the 'terminal 
> type' telnet option at session negotiation. Browsing through other 
> dissector code I can't find a canonical way of storing information about a 
> given stream, other than possibly misusing the conversation api. I'm sure 
> I'm missing a trick. What is the standard way of recognizing that a packet 
> is from a stream previously identified as requiring a specific 
> sub-dissector?

I think the only (and best) way to do that is to store the info in a 
conversation structure.  I've always thought the purpose of 
conversations was to store info for later (subsequent packet) use. 
(Then again: I've never used them.)
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@wireshark.org?subject=unsubscribe
[prev in list] [next in list] [prev in thread] [next in thread]