Wireshark-dev: Re: [Wireshark-dev] Question about port registrations
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 27 May 2009 15:10:42 -0700

On May 27, 2009, at 2:26 PM, Bryant Eastham wrote:
Q: Does “dissector_add” differentiate between src and dst port? [I think not, the registration is by name and the dissector (TCP) chooses how to use it.] 

No.
Q: Does wireshark prioritize between built-in vs. plugin dissectors? [I think not.] 

No.
Q: Does wireshark prioritize between dissectors based on matches on src vs. dst port? 

No.
It prioritizes based on the port number; lower port numbers are preferred to higher port numbers, as they're more likely to be well- known ports.
My fundamental issue is that I would expect that priority be given to the dissector on the *server* (dst) port, as it is the more likely to be standardized vs. ephemeral.
The destination port is the server port only for requests. If the capture includes the entire session, all the way back to the initial SYN, and we remember, for each new TCP connection, the source and destination ports for the initial SYN, we can determine, for packets in that connection, which port is the "client" port and which the "server" port.