[Yaniv Kaul <ykaul@xxxxxxxxxxxx>]

Patches for packet-http.c, packet-dcerpc.c, packet-dcerpc-epm.c that add 
dissection of RPC over HTTP.
In addition, the HTTP patch changes the 'Continuation' information to be 
'Continuation or non HTTP traffic' , which sometimes is the case...

Index: packet-dcerpc.c
===================================================================
--- packet-dcerpc.c	(revision 12680)
+++ packet-dcerpc.c	(working copy)
@@ -4874,5 +4874,6 @@
     heur_dissector_add ("netbios", dissect_dcerpc_cn_pk, proto_dcerpc);
     heur_dissector_add ("udp", dissect_dcerpc_dg, proto_dcerpc);
     heur_dissector_add ("smb_transact", dissect_dcerpc_cn_smbpipe, proto_dcerpc);
+	heur_dissector_add ("http", dissect_dcerpc_cn_bs, proto_dcerpc);
     dcerpc_smb_init(proto_dcerpc);
 }

Index: packet-http.c
===================================================================
--- packet-http.c	(revision 12680)
+++ packet-http.c	(working copy)
@@ -347,7 +347,7 @@
 			col_add_str(pinfo->cinfo, COL_INFO,
 			    format_text(line, first_linelen));
 		else
-			col_set_str(pinfo->cinfo, COL_INFO, "Continuation");
+			col_set_str(pinfo->cinfo, COL_INFO, "Continuation or non HTTP traffic");
 	}
 
 	orig_offset = offset;
@@ -1239,6 +1239,9 @@
 			} else if (strncmp(data, "UNSUBSCRIBE", index) == 0) {
 				*type = HTTP_NOTIFICATION;
 				isHttpRequestOrReply = TRUE;
+			} else if (strncmp(data, "RPC_CONNECT", index) == 0) {
+				*type = HTTP_REQUEST;
+				isHttpRequestOrReply = TRUE;
 			}
 			break;
 

Index: packet-dcerpc-epm.c
===================================================================
--- packet-dcerpc-epm.c	(revision 12680)
+++ packet-dcerpc-epm.c	(working copy)
@@ -67,7 +67,7 @@
 static int hf_epm_proto_ip = -1;
 static int hf_epm_proto_udp_port = -1;
 static int hf_epm_proto_tcp_port = -1;
-
+static int hf_epm_proto_http_port = -1;
 static gint ett_epm = -1;
 static gint ett_epm_tower_floor = -1;
 static gint ett_epm_entry = -1;
@@ -273,7 +273,7 @@
 #define PROTO_ID_UNIX_DOMAIN	0x20
 #define PROTO_ID_NULL		0x21
 #define PROTO_ID_NETBIOS_3	0x22
-
+#define PROTO_ID_HTTP 0x1f
 static const value_string proto_id_vals[] = {
 	{ PROTO_ID_OSI_OID,		"OSI OID"},
 	{ PROTO_ID_DNA_SESSCTL,		"DNA Session Control"},
@@ -303,6 +303,7 @@
 	{ PROTO_ID_UNIX_DOMAIN,		"Unix Domain Socket"},
 	{ PROTO_ID_NULL,		"null"},
 	{ PROTO_ID_NETBIOS_3,		"NetBIOS"},
+	{PROTO_ID_HTTP, 		"RPC over HTTP"},
 	{ 0, NULL},
 };
 
@@ -415,7 +416,11 @@
             proto_tree_add_item(tr, hf_epm_proto_netbios_name, tvb, offset, len, TRUE);
             proto_item_append_text(tr, "NetBIOS:%*s",MIN(len,tvb_length_remaining(tvb, offset)), tvb_get_ptr(tvb, offset, -1)); 
             break;
-
+		case PROTO_ID_HTTP: /* RPC over HTTP */
+            proto_tree_add_item(tr, hf_epm_proto_http_port, tvb, offset, 2, FALSE);
+            proto_item_append_text(tr, "RPC over HTTP Port:%d", tvb_get_ntohs(tvb, offset));
+            break;
+			
         default:
             if(len){
                 proto_tree_add_text(tr, tvb, offset, len, "not decoded yet");
@@ -707,6 +712,8 @@
           { "UDP Port", "epm.proto.udp_port", FT_UINT16, BASE_DEC, NULL, 0x0, "UDP Port where this service can be found", HFILL }},
         { &hf_epm_proto_tcp_port,
           { "TCP Port", "epm.proto.tcp_port", FT_UINT16, BASE_DEC, NULL, 0x0, "TCP Port where this service can be found", HFILL }},
+		{ &hf_epm_proto_http_port,
+		  { "TCP Port", "epm.proto.http_port", FT_UINT16, BASE_DEC, NULL, 0x0, "TCP Port where this service can be found", HFILL }},      
         { &hf_epm_tower_rhs_len,
           { "RHS Length", "epm.tower.rhs.len", FT_UINT16, BASE_DEC, NULL, 0x0, "Length of RHS data", HFILL }},
         { &hf_epm_tower_lhs_len,