> I've done a modification to packet-udp.c so that is calls dissect_radius
> whenever it sees one of the
> standard radius ports in the source or destination ports of the udp packet.
> A better approach would
> probably be to match responses to requests (I don't know if all radius
> servers use a standard port as the source port for their responses,
If not, that sounds like the way TFTP works, so modeling it after
"packet-tftp.c" might work (it remembers the source port of the request,
and looks for stuff sent to that port).
> taking
> the minimum of source and destination port doesn't work in all cases so i
> didn't put the call in the switch),
The stuff you put in:
> if ((UDP_PORT_RADIUS==uh_sport)|| (uh_dport==UDP_PORT_RADIUS)||
> (UDP_PORT_RADACCT==uh_sport)||(uh_dport==UDP_PORT_RADACCT)||
>
> (UDP_PORT_RADIUS_NEW==uh_sport)||(uh_dport==UDP_PORT_RADIUS_NEW)||
>
> (UDP_PORT_RADACCT_NEW==uh_sport)||(uh_dport==UDP_PORT_RADACCT_NEW))
is similar to what we do in "packet-tcp.c":
#define PORT_IS(port) (th.th_sport == port || th.th_dport == port)
...
if (PORT_IS(TCP_PORT_PRINTER))
dissect_lpd(pd, offset, fd, tree);
else if (PORT_IS(TCP_PORT_TELNET)) {
pi.match_port = TCP_PORT_TELNET;
dissect_telnet(pd, offset, fd, tree, payload);
...
so I should move the "PORT_IS()" macro out of "packet-tcp.c" into a
header file, and have "packet-udp.c" use it as well.
(Long term, we should probably have the port lookups done in a table
expandable at run-time; Richard Sharpe put in some stuff to do that.)
