[Guy Harris <guy@xxxxxxxxxxxx>]

On Sat, Nov 29, 2003 at 04:31:47AM -0800, john g wrote:
> "Follow TCP Stream" for http:
> 
> the content of http stream is displayed encoded (guess
> here),

Only if the data in the stream is itself encoded.  For non-encoded HTTP
streams, i.e. streams where the TCP segments contain text, the content
of the stream is displayed as text.

> Next to the "Follow TCP Stream" is "Decode As". where
> and for which type of protocols would one use decode
> as ?

One would mainly use it for protocols that

	1) don't have standard TCP or UDP port numbers or that do but
	   don't happen to be using those ports;

	2) don't have heuristic dissectors;

	3) haven't been assigned to particular conversations by virtue
	   of earlier packets in the capture.

> please give an example where one would use the Decode as.

One might use it for RTP/RTCP traffic if earlier RTSP or SIP/SDP traffic
weren't present in the capture to let Ethereal know what port numbers
would be used for that RTP/RTCP traffic.