Guy Harris said:
>
(snip)
>
> Actually, what we might want there is a way to have "Decode
> As..." specify
> conversation dissectors, in addition to be able to specify
> dissectors for
> specific port numbers, so that it'd
>
> 1) not be overridden by conversation dissectors (because
> it'd *be* the
> dissector for that conversation)
>
> and
>
> 2) apply only to that conversation
>
> and also allow it to specify dissectors for circuits.
>
This might also help with the recognition of DCE subdissectors
when a conversation doesn't include the bind (capture started mid-stream).
I'd posted a trial patch with a silly heuristic for doing this a while
back, but it had hard-coded values and no UI. I've still not had time
to work on the UI (do little enough UI work as it is, and have zero
experience with GTK). If somebody wanted to modify Decode As... to get
it closer to this, I'd be happy. :-)
regards, Eric
*********************************************************************
This e-mail and any attachment is confidential. It may only be read, copied and used by the intended recipient(s). If you are not the intended recipient(s), you may not copy, use, distribute, forward, store or disclose this e-mail or any attachment. If you are not the intended recipient(s) or have otherwise received this e-mail in error, you should destroy it and any attachment and notify the sender by reply e-mail or send a message to sysadmin@xxxxxxxxxxx
*********************************************************************