From owner-freebsd-hackers@FreeBSD.ORG Fri Mar 4 16:11:00 2005 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7A3D016A4CE for ; Fri, 4 Mar 2005 16:11:00 +0000 (GMT) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.196]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0FB8E43D4C for ; Fri, 4 Mar 2005 16:11:00 +0000 (GMT) (envelope-from opensource.enthousiat@gmail.com) Received: by wproxy.gmail.com with SMTP id 69so740054wri for ; Fri, 04 Mar 2005 08:10:56 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding; b=C6rMcPdkAV7PmOy2phs0ezQqqHMxpcxTgUuv/HT7xw7AKGTyZOnW8WVrA+gO02FuI+9cQHZKBo03k8KSHhLJk2lmUj78fivnI+hjcFvJck/aA8GYtcEHVegunRaoa+7F+BUdzxjJWrA4XOXOEWTf/uewaMC2AY1preVttXCNRaY= Received: by 10.54.34.52 with SMTP id h52mr15086wrh; Fri, 04 Mar 2005 08:08:34 -0800 (PST) Received: by 10.54.49.28 with HTTP; Fri, 4 Mar 2005 08:07:34 -0800 (PST) Message-ID: <37e13166050304080715525d7e@mail.gmail.com> Date: Fri, 4 Mar 2005 11:07:34 -0500 From: Aziz KEZZOU To: freebsd-net@freebsd.org, hackers@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: generic network protocols parser ? X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Aziz KEZZOU List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2005 16:11:00 -0000 Hi all, I am wondering if any one knows about a generic parser which takes a packet (mbuf) of a certain protocol (e.g RSVP ) as input and generates some data structre representing the packet ? I've been searching for a while and found that ethereal and tcpdump for example use specific data structres and functions to dissect each protocol packets. Is this the only approach possible ? My supervisor suggested using a TLV (Type/Length/Value) approach instead. Any opinions about that? If no such a parser exists is there any practical reason why ? Thanks, Aziz