| Bug ID |
9469
|
| Summary |
Patch: set dissector for a specific source+dest port combination
|
| Classification |
Unclassified
|
| Product |
Wireshark
|
| Version |
1.11.x (Experimental)
|
| Hardware |
All
|
| OS |
All
|
| Status |
UNCONFIRMED
|
| Severity |
Enhancement
|
| Priority |
Low
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
[email protected]
|
| Reporter |
[email protected]
|
| Attachment #12148 Flags |
review_for_checkin?
|
Created attachment 12148 [details]
Patch to add "conversation" to decode-as menu
Build Information:
Build Information:
wireshark 1.11.1 (SVN Rev Unknown from unknown)
Copyright 1998-2013 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 3.4.4, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.32.4, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.1, without Python, with GnuTLS 2.12.18, with Gcrypt 1.4.6,
with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Nov 18 2013),
with AirPcap.
Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.3
(packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.12.18, Gcrypt 1.4.6, without AirPcap.
Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz, with 511MB of physical memory.
Built using Microsoft Visual C++ 10.0 build 40219
--
This patch adds a new entry ("conversation") in the decode-as dialog for TCP
and UDP which applies the selected dissector to packets between the source and
destination ports. The "conversation" entry has "AND" logic where the existing
"both" entry has "OR" logic.
My use case for this is a situation where a server can speak multiple protocols
on a single port and a single dissector cannot correctly determine which
protocol is in use (e.g. if initial handshake is not captured).
Developed against 1.11.2 source.
You are receiving this mail because:
- You are watching all bug changes.