On Wed, 26 Sep 2001, Guy Harris wrote:
> which makes it clearer that the heuristics are still required.
Ok.
> Currently, we don't, for connection-oriented protocols, have any way for
> the transport-layer dissector to tell the dissector it calls that a
> given piece of data is the first piece of data in a new connection, so,
> for now, the heuristics are required for all sessions.
>
> Is there any reason *not* to use the heuristics for all sessions?
No, I just thought "why use the heuristics even for cases in which you can
do without them?". However, since the TCP dissector currently doesn't have
support for this, I understand that's the only way.
Moreover, I will add some heuristics for replies.
> > I thought to keep a cache of these data: i.e.
[snip]
> That's what we do for other protocols where you need the request in
> order to dissect the reply, e.g. ONC RPC and SMB transactions.
I'll try to implement the cache, thank you.
> > The problem is that the packets could be out of order on the wire: in that
> > case the cache would be useless.
>
> "Out of order" in what sense? Are you talking about a reply being seen
> before the matching request?
Please never mind. (Silly me)
Thank you,
Zun.