Hi, I must have been smokin some really good stuff when I did those mods for the TFTP protocol. I forgot that when I use ethereal, I am going to have a class full of students who will all be monitoring TFTP sessions. So there will be at least n/2 sessions going, plus possibly other UDP related stuff going on. This means that I need a way to distinguish between them, and I should try to remove the dissect_tftp routine from the dispatch table when I see the last block of a tftp transfer. As Guy suggested, I should probably include the (source and dest) IP address(es) in the hash that I am constructing. I was thinking of a hash where I simply add together, byte by byte, the SIP, DIP, SPORT, and DPORT. Will this distribute the things across enough of the hash table entries? I don't whant too many collissions. Regards ------- Richard Sharpe, sharpe@xxxxxxxxxx, NIC-Handle:RJS96 NS Computer Software and Services P/L, Ph: +61-8-8281-0063, FAX: +61-8-8250-2080, Samba (Team member), Linux, Apache, Digital UNIX, AIX, C, ...
Powered by MHonArc 2.6.10