Re: Add dialogs using plugins

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to [email protected].
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-dev
-------------------

Broadway, Joshua Paul - BROJP002 wrote:
> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to [email protected].
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> -------------------
> 
> 
> 
> ------------------------------------------------------------------------
> 
> Hi all,
> 
> I'm very new to Ethereal and I'm interested in developing plugins for it.
> 
> I'm interested in using Ethereal for producing output in different 
> formats (other than standard Ethereal GUI format) to make it easier for 
> the user to extract information from the packet data.

Note that, as per the item added to your mail by the Ethereal mailing 
list software, none of the former Ethereal core team are working on 
Ethereal any more - they're all working on Wireshark.

As such, no new Ethereal releases have come out in a while, and no bug 
fixing or new feature work has been done on Ethereal.  That work is 
being done on Wireshark.

> In the developer help pages there's a section (9.4) about how to 
> add/extend dialogs. However there's no useful information in the section.
> 
> Is it possible to develop plugins for Ethereal that create and display 
> new dialogs to the user? Or are the plugins limited to extracting new 
> protocol information from the data?

Currently, two types of plugins can be written:

	1) dissectors, which can only dissect packet data and add information 
to the summary line and the packet details;

	2) taps, which can process data handed to them by a dissector or can 
process the raw protocol tree.

Dissectors are limited to extracting new protocol information from the 
data.  Taps could probably do the sort of processing you want.

> If it is possible to develop new dialogs, are there some some resources 
> that I could be pointed to for reference?

See docs/README.tapping for some information on writing a tap.

See tap-protohierstat.c for an example of a tap that processes the raw 
protocol tree.

See plugins/stats_tree for an example of a plugin tap.