On Feb 10, 2011, at 11:38 AM, Bill Meier wrote: > There are two approaches to processing the pseudo-header: > > 1. libpcap processes the pseudo-header and fills in a dissector-specific > structure which is eventually passed to the DVBCI dissector > (pinfo->pseudo_header) along with the actual data. > > See wiretap/libpcap.c wiretap/pcap-common.c/process_pseudo_header() > and epan/dissectors/packet-frame.c > > This approach is used by most of the dissectors which need info > such as "direction". > > 2. The dissector processes both the pseudo-header and the actual data. > I.E., From the Wireshark perspective, the pseudo-header is just part > of the captured data (similar to the code in your original patch). > > This is the approach used by packet-radiotap.c > > --------- > > I don't know if there are reasons to prefer the first approach even if the > changes (other than the dissector itself) are slightly more extensive. (Code > must be added to libpcap to handle the pseudo-header). > > I expect one of the other core-developers (Guy ?) can give some guidance.
At this point, I prefer the second approach. The Linux USB dissector now uses that, as of revision 32534; switching to that cleaned things up. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
