On Mar 4, 2007, at 6:44 PM, Shehjar Tikoo wrote: > Thanks. I've been looking at the tap mechanism as a mechanism for the > anonymizer and I see that we'll have to add calls to > tap_queue_packet(..) in every packet-nfs.c:dissect_nfs_<messagetype> > call to queue the message for the tap listener.
No, we won't. See, for example, the protocol hierarchy tap in tap-protohierstat.c. It attaches to the "frame" tap, which gets called after the "frame" dissector is finished; as that's the top-level dissector that "dissects" the packet time stamp and lengths, it's not finished until all dissection is complete, so the protocol tree is completely constructed at that point. That tap's "packet" routine walks through the protocol tree. _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
