Wireshark · Ethereal-dev: Re: [Ethereal-dev] Addition of SMPP dissector

[Guy Harris <guy@xxxxxxxxxx>]

> One of the things I like so much about Ethereal is that it'll present you
> immediately with a best guess (usually right) without required interaction.
> Heuristics will do that for you.

How right the guess is depends on how good the heuristics are; overly
weak heuristics, that reject too few packets, can cause some annoyance.

Adding a heuristics to the X.25 dissector would be a good start, but
we'd probably want something to override it if there are protocols for
which there aren't good heuristics.

> > 	2) add a mechanism in the UI to let the user specify what
> > 	   protocol is to be used for the virtual circuit to which the
> > 	   currently selected frame belongs
> 
> I'd say option 2 would be preferred (presuming that it would be like the
> "Decode as" under TCP/UDP), option 1 might still not cover, for instance, a
> trace with both UCP and SMPP traffic in it.

Yes, that's what I was thinking.

Actually, it's not *exactly* like "Decode as" - it'd be more like a
"Decode as" that attaches a dissector to a *conversation* (which,
frankly, I think would be a Good Idea for TCP and UDP).

> Lot of work?

Doing it right would involve some work, so that the UI code doesn't have
to have knowledge of X.25 and TCP/UDP conversations and so on wired into
it (so you don't have to hack on the UI code every time you add a new
"decode this conversation as" mechanism).