Wireshark-dev: [Wireshark-dev] Wireshark "Decode As"

From: João Valverde <joao.valverde@xxxxxxxxxxxxxxxxxx>
Date: Tue, 15 Sep 2015 15:41:43 +0100
Hi,

I'm trying to understand and troubleshoot some "Decode As" issues. To give an example consider the packet:

IPv6 | IPv6 | UDP

Wouldn't the second IPv6 layer overwrite the Decode As protocol number for the first layer, giving:

IPv6 (Decode IP protocol 17 As:) | IPv6 (Decode IP protocol  17 As:) | UDP

Instead of the correct:

IPv6 (Decode IP protocol 41 As:) | IPv6 (Decode IP protocol 17 As:) | UDP

Is this a bug, a known limitation of the current code, or just my misunderstanding?

I don't think it is specific to IPv6, it's just an example. If it is a limitation it seems the Decode As proto_value() interface needs to be extended somehow, feedback very welcome.

Thanks,

João V.