Attached is a sample PDML file from tethereal.I would have thought the <proto> tags should nest. If they dont, isn't there an ambiguity between:
<proto> </proto> <proto> </proto>
and
<proto>
<proto>
</proto>
</proto>
In my view, only the first syntax sould be allowed. For instance, in real world protocols are nested (Ethernet includes IP that includes TCP...). However, when you display such a packet on the screen, you should display it as:
ethernet field1 field2 .... IP field1 ....
So, it is much easier not to have nested <proto> tags, since this is not what you want in the output.
This is how PDML has been defined so far.
Just my idea, obviously.
I agree on that - the structure of different [t]ethereal output formats should be the same. So <proto> tags should *not* be nested, while it makes sence for the <field> tags. As you do in PDML.
Examining the sample output as provided by Gilbert, it is compliant to that spec. except for the <proto name="data" ...> tag at the bottom as it is nested within <proto name="http" ...>. Shouldn't the data be a <field> tag within the html proto-tag, as it is part of the http protocol? So, in my opinion, it should look like this:
<proto name="http" size="644" pos="54"> ... <*field* name="*http.*data" showname="Data (238 bytes)" size="238" pos="460" value="3c686..."/> </proto>
Or am I missing a point here??
Gilbert, do you mind making the code available somehow? So I could take a closer look at it as well... I have allocated some time for working on the XML output anyway already ;-)
carsten
_______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
