Wireshark-dev: Re: [Wireshark-dev] New Dissector only applied to first packet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jan Willamowius <jan@xxxxxxxxxxxxxx>
Date: Fri, 2 Nov 2012 22:25:04 +0100
Guy Harris wrote:
> > My dissector only handles UDP packets, but strangely the stop-packets
> > are all TCP packets and I have verified that my dissector never even
> > gets called for them.
> 
> A dissector for one protocol can set up future (in the sense of "later in the capture") packets to or from certain endpoints to be dissected as a particular protocol.  This is used, for example, for protocols such as SIP, which initiate a session and specify "use port XXX" for that session, so that future UDP traffic to or from port XXX should be dissected as RTP for that session.
> 
> What protocol(s) are in the TCP packets in question?

Thats it!

I'm doing a dissector to decode the H.460.19 RTP multiplexing used by
H.323 and the packets I have to ignore contain openLogicalChannel
messages that probably set up rules to decode future packets as RTP.

Is there a way to override these rules for future packets ?
Or is the only way to adapt the dissector for H.323 to auto detect when
RTP multiplexing is used ?

To start out I was planning to use a manual Decode As instead of the
more difficult auto-detect.

Regards,
Jan
-- 
Jan Willamowius, jan@xxxxxxxxxxxxxx, http://www.willamowius.de/