Hi,

Is it a good practice to register some entries of hf_register_info array from dissect_XXX function instead of proto_register_XXX() function.

Reason being : the value_string structure assigned to some fields(through vals() function) changes based on the data fetched from packet in dissector code. Basically I have a requirement where the same field and with the same value will be assigned different names based on some data part of packet.

Looking for your help..Thanks in advance :)

asked 02 Mar '12, 10:24

ashish_goel's gravatar image

ashish_goel
15121216
accept rate: 0%


The normal approach for this kind of thing is to just register all the possible hf's you might need. So: it is not good practice to register them in the dissect_XXX() function.

There are times when it's truly not possible to register them all ahead of time; I'm thinking of, for example, the MATE plugin: the hf's it needs depend on the configuration file. IIRC it does some kind of delayed initialization. But I'm pretty sure it's still done before dissection begins.

link

answered 05 Mar '12, 11:15

JeffMorriss's gravatar image

JeffMorriss ♦
3.3k448
accept rate: 26%

can you elaborate a more on the delayed initialization part?? How it is done before dissection??

(05 Mar '12, 19:09) ashish_goel

Actually I'm not too sure: I just know (well, I'm pretty sure anyway) that the MATE plugin can't register it's hf_ entries until it has read its configuration file which means it ends up regitering the hf_ entries "late." But I could be wrong about that. If you're really interested, I'd suggest studying how MATE does it.

(06 Mar '12, 06:50) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×335
×120
×5

Asked: 02 Mar '12, 10:24

Seen: 1,894 times

Last updated: 06 Mar '12, 06:50

powered by OSQA