> packet-mq-pcf is a MQ subdissector for the "MQ Programmable Command
Formats
> protocol" (it allows remote configuration of the MQ server (queue
manager)).
Checked in, with some compiler warnings cleaned up.
The "heuristic" dissector doesn't appear to look at the packet itself;
it appears to look at a string field from the MQ packet, supplied to the
subdissector through the private_data pointer.
If it's always the case that a format property value of "MQADMIN ",
"MQEVENT ", or "MQPCF " always means it's a PCF packet, that should
probably be done, instead, with a string dissector table in the MQ
dissector, with the PCF dissector registering itself in that dissector
with values of MQ_FMT_ADMIN, MQ_FMT_EVENT, and MQ_FMT_PCF.
Guy,
Here is the rationale behind that decision.
MQ has a series of about 20 pre-defined message formats.
One important feature of MQ is the character set conversion, which allows
EBCDIC mainframes to talk to ASCII workstations.
Conversion only works with one of the pre-defined message formats.
An application can define its own message format but it will considered as
binary by MQ (no conversion).
http://www.developer.ibm.com/tech/faq/individual?oid=2:13624
http://www.developer.ibm.com/tech/faq/individual?oid=2:26099
In the end, nearly all applications use the MQFMT_STRING and the MQFMT_NONE
message formats.
Even IBM applications like WBIFN (WebSphere Business Integration for
Financial Networks) use MQFMT_STRING.
The PCF format is an exception because it has its own pre-defined message
format.
So a "normal" MQ subdissector can only rely on a heuristic method to
recognise the packet or not.
See you,
metatech
