On Fri, 26 Jan 2001 10:11:54 -0500 (EST)
LISA M REDEKOP <lrede024@xxxxxxxxxx> wrote:
>
> Hello.
> This is Lisa Redekop (a University of Ottawa student).
> I have two questions for you.
>
> Q1. I have a sample of packets where there is RTSP
> on top of TCP, but port 7070 is being used instead
> of port 554 (the standard RTSP port).
> Ethereal does not dissect the RTSP layer, could you
> suggest a way to do this? (point me in the right
> direction <but read Q2 before answering>)
The easiest (only?) way to do this now is to change
the Ethereal source code. At the bottom of packet-rtsp.c you'll
see:
dissector_add("tcp.port", TCP_PORT_RTSP, dissect_rtsp, proto_rtsp);
where TCP_PORT_RTSP is #defined at the top of the same file as 554.
Just add another line like the one above:
dissector_add("tcp.port", 7070, dissect_rtsp, proto_rtsp);
> Q2. I thought of "grepping" for RTSP or other words
> unique to RTSP and starting a conversation, however
> these packets that I'm interested in have a layer on
> top of RTSP for which I've already started a convesation.
> Is it possible to have two dissectors for one
> conversation (maybe using conversation.old_d,
> conversation.new_d)? And what are the fields old_d
> and new_d used for?
>
I'll let others who are more familiar with the conversation code
answer that one.
--gilbert