https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4721
Sake <sake@xxxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WONTFIX |
--- Comment #5 from Sake <sake@xxxxxxxxxx> 2010-05-07 23:52:30 PDT ---
It looks like it is just a GUI problem, the decode as functionality does work
for ethertype 0x0000 and 0xffff:
macsake:Downloads sake$ tshark -c 10 -r roger.pcap -d ethertype==65535,ip -d
ethertype==0,ip
1 0.000000 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0000)
2 0.000033 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=1461 Win=32768 Len=0
3 0.007917 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0000)
4 0.015817 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0000)
5 0.015836 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=4381 Win=32768 Len=0
6 0.023728 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0050)
7 0.028336 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=5841 Win=32403 Len=0
8 0.033801 156.124.71.207 -> 156.124.42.84 TCP scoremgr > wcpp [PSH, ACK]
Seq=1 Ack=1 Win=14766 Len=90
9 0.033804 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0020)
10 0.033825 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=7301 Win=32768 Len=0
macsake:Downloads sake$
(don't be misled by the "Unknown type (0x0000)", they are produced by the NCP
dissector, the frames are indeed dissected as IP)
So I guess there is a little bug in the code that decides whether "Decode
As..." should be greyed out or not. I'll have a look...
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.