> 2) Are there any other protocols, beside TCP and UDP that need to
> look for conversational dissectors?
OK, This is me "coming out". I am trying to get a H.323 dissector
working for Ethereal and I think I could use this kind of
functionality.
> 3) Should TCP and UDP do a conversation lookup before or after the
> current sub-dissector search code? Doing the lookup first will
> provide the best chance to finding a conversation that happens to
> use a 'well-know port', at the expense of the hash table lookup for
> every packet.
Before. First try to dissect an incoming packet by dissectors that claim
it specifically, then those that have to do so by default.
--
Andreas Sikkema
andreas.sikkema@xxxxxxxxxxx
"Standing barefoot in a river of clues, most people would
not get their toes wet." - Brian Kantor in a.s.r.
Powered by MHonArc 2.6.10