I think both suggestions are good, and would solve this problem.
The actual problem I have now is not a crash, but a short frame, the
dissector exits leaving the dissection incomplete, although the complete
message is visible in the hex dump section. The sip client is Microsoft
Messenger 5.0. The epid parameter in the From header (and other headers
sometimes) appears to be the cause of the short frame, as in the
following exported text. Note that some of the next line seems to be
appended after the \r\n.
C:\Program Files\Ethereal>tethereal.exe -v
tethereal 0.10.4
Compiled with GLib 2.2.3, with WinPcap (version unknown), with libz
1.2.1,
with libpcre 4.4, with Net-SNMP 5.1, with ADNS.
Running with WinPcap (version unknown) on Windows XP Service Pack 1,
build 2600.
No. Time Source Destination Protocol
Info
40 24.384869 10.4.1.58 10.100.251.21 SIP
Status: 200 OK[Short Frame]
Session Initiation Protocol
Status-Line: SIP/2.0 200 OK
Status-Code: 200
Message Header
Via: SIP/2.0/UDP
10.100.251.21:5060;branch=9912b499-50c62c48-1b8deccb-110776b0-1
Via: SIP/2.0/TCP 10.4.1.55:5060;received=10.4.1.55
From: <sip:1055@xxxxxx:5060>;epid=4e4fb3722c03203f
SIP from address:
<sip:1055@xxxxxx:5060>;epid=4e4fb3722c03203f\r\nTo:
1058<sip:1058@xxxxxx>
[Short Frame: SIP]
Thanks,
Russ.
Martin Regner wrote:
I'm using both of them at same time since I often want to look at the
raw SIP-message, but
I also want to do easy filtering with "Analyse/Prepare a filter" and
also want the SDP
dissector to startup RTP conversations and similar.
It might be good to have an option to disable the "tree dissection" for
those that want that
and just have the "raw text format", similar to how there is two
checkboxes in Megaco dissector.
Another alternative could be to use a enum preference that
can used to select between
-Tree Dissection Only
-Tree Dissection+Raw
-Raw+Tree Dissection
-Raw Only.
The SIP-dissector in Ethereal 0.10.4 shouldn't crash, I think.
There was a problem in Ethereal 0.10.3.
If you have any remaining crash problems with 0.10.4, please send a
bug-report.