On Tue, Mar 12, 2002 at 09:12:36AM -0600, Ron Flory wrote:
> 1. TFTP packets are incorrectly reported as (invalid) WCCP packets.
> If I disable the WCCP protocol, TFTP packets are correctly decoded.
> I would assume the correct action would be to fix the WCCP dissector
> so that it does not (incorrectly) claim TFTP packets as its own.
That's part of a general problem, not specific to TFTP or WCCP. If a
TCP or UDP packet has both source and destination port numbers for which
dissectors are registered, there's no guarantee that the correct
dissector will be picked.
Unfortunately, there's currently no mechanism to allow a dissector to
reject packets. That may show up at some point, although that'll work
only if a dissector can function, to some extent, as a heuristic
dissector; the problem with heuristics is that they run the risk of
either being too strong, and rejecting packets when they shouldn't be
rejected (after all, one of the purposes of a network analyzer is to
track down problems due to machines sending invalid packets), or being
too weak, and accepting packets for other protocols.
I.e., there's no guarantee that this will *always* give the desired
answer. Things will probably improve over time, but there may still be
cases where human intervention is necessary.
> 2. The action of disabling the WCCP protocol (to work-around the above
> issue) is not preserved across Ethereal sessions, nor can I seem to
> find how/where to save these settings so that I don't have to manually
> disable WCCP every time I start Ethereal.
As with many other missing features in Ethereal, nobody's gotten around
to implementing any mechanism to save or load protocol enabled/disabled
settings. That might be an interesting project for a new developer
(they should consider, while they're at it, adding a command-line
interface so protocols can be disabled from the command line in Ethereal
and Tethereal). The settings should be saved in a file in the directory
in which other preference files are stored (preferably a text file).