Hi,
You wrote the heuristic engine does the work.
I think it does not recognize all the Corba traffic.
It tells me there is 'Data (76 bytes)' at the end of
the headers of this UDP datagram.
In the Hex dump I clearly see the words 'Message' and
'ORBeline 2.0' which means it is corba traffic.
Is the heuristic engine configurable to look also for
this packet's signature? Or does this need a
re-compile.
- Bob
----8<---old-mail---8<------
On Thu, Mar 07, 2002 at 03:58:11AM -0800, Bob wrote:
> Where is the decode GIOP option.
There isn't one.
The GIOP dissector is a "heuristic" dissector, meaning
that, instead of
specific TCP (or UDP) port numbers being defined as
GIOP ports, the GIOP
dissector is called for any packet that's not
dissected based on a port
number, and, if the beginning of the TCP segment (or
UDP packet) looks like
the beginning of a GIOP message, the segment/packet is
dissected as a
GIOP message.
I.e., you don't have to say "decode this port number
as GIOP", and
there's no support for doing so. You may have to say
"don't decode this
port number as XXX", for some "XXX", if that port
number is being used
for GIOP rather than for protocol XXX.
__________________________________________________
Do You Yahoo!?
Try FREE Yahoo! Mail - the world's greatest free email!
http://mail.yahoo.com/