Wireshark-dev: Re: [Wireshark-dev] Decode As... Questions
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 30 Apr 2008 16:46:11 -0700

On Apr 30, 2008, at 11:05 AM, Peter Fuller wrote:



In the past, I have come across some data that was one transport
layer carried in another (TCP carrying UDP).
I.e., a byte stream containing a sequence of UDP header+payload items? (The UDP header contains a length, so that can be done without requiring a protocol in between TCP and UDP as an adaptation layer.) 


Is there a reason that the transport layers are not
included in the 'Decode As...'  list ?
Because nobody's made the transport layers register themselves as belonging in that list. It might be possible to make UDP do so, *if* the IP endpoint addresses of the encapsulated UDP packets are the same as the IP endpoint addresses of the TCP connection (otherwise, there needs to be a protocol in between TCP and UDP to provide those addresses).