On Fri, Jan 12, 2007 at 07:19:59PM +0000, Martin Warnes wrote:
> The Connect:Direct protocol in this case is just a header record:
>
> 54 43 50 32 00 02 00 10 00 00 00 09 .S..TCP2........
> 0050 80 00 00 00 38 00 00 00
>
> and the SSL payload:
>
> 16 03 01 00 04 0e 00 00 ....8...........
> 0060 00
In this case, your dissector should call the SSL dissector once its done
processing its own data. See epan/dissector/packet-eap.c for an example
of calling SSL as a sub-dissector (look for each instance of "ssl_handle"
and how it builds next_tvb before calling it).
Steve