Wireshark-dev: Re: [Wireshark-dev] SVN revision 36640 and heuristic dissectors
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 25 Oct 2010 11:12:42 -0400
Pascal Quantin wrote:

Hi,
since revision 34640, none of UDP heuristic dissectors I use (LTE-MAC, LTE-RLC or LTE-PDCP) work: all the frames are decoded as ADwin configuration protocol.
When looking at the code in function dissect_adwin_config() (file packet-adwin-config.c), the heuristic seems a bit weak: 
[...]
    length = tvb_reported_length(tvb);

    if (pinfo->ipproto == IP_PROTO_UDP &&
        ! (length == UDPStatusLENGTH
           || length == UDPExtStatusLENGTH
           || length == UDPMessageLENGTH
           || length == UDPMessageLENGTH_wrong
           || length == UDPInitAckLENGTH
           || length == UDPIXP425FlashUpdateLENGTH
           || length == UDPOutLENGTH))
        return (0);
[...]

Could it be possible to do something more robust ?


Oops, sorry.  We're discussing some stronger heuristics in bug 5324.