> > is binded to the packet between server_ip and client_ip. > > At some point, if we implement the ability to set per-conversation > attributes in the UI, we might want to use that mechanism for this.
I did some tests with conversation: in dissect_tacplus I setup the conversation, if new I save the key with conversation_add_proto_data, otherwise I retrieve the key with conversation_get_proto_data. But dissect_tacplus is called for every tacplus packet, and it has to call find_conversation. I thought that give too much overhead ( but i don't know how much ), and no benefit. So I implemented the key lookup I sent. If i'm not wrong, the conversation dissector is called only from try_conversation_dissector. What about adding a pointer so the conversation dissector knows his conversation_t * ? In that way, the conversation handler doesn't need to go through find_conversation again... > By the way, why did you make this change: > > - gboolean request=(pinfo->match_port == pinfo->destport); > + gboolean request=( pinfo->destport == TCP_PORT_TACACS ); > > The former should work even if a port other than the standard TACACS port > is being used; the latter requires that the standard TACACS port is being > used. Is there some case where the first of those didn't work? I made the change while I was experimenting with conversation: found that match_port was null when the handler was called by try_conversation_dissector. May be I could add a preference entry for the port ( default to 49/tcp ). -- Ciao, Emanuele
