Wireshark · Wireshark-dev: [Wireshark-dev] Determining how Wireshark detects T.38

[Rayne <hjazz6@xxxxxxxxx>]

Hi all,

I'm trying to follow the Wireshark source code to find out exactly how Wireshark determines that the layer above UDP or RTP is a T.38 payload. 

I assume that a heuristic dissector is used since there is no known port for T.38. So I started with packet-udp.c, and eventually got to the line below in the function "decode_udp_ports()".

if (dissector_try_heuristic(heur_subdissector_list, next_tvb, pinfo, tree, &hdtbl_entry, NULL))

However, when I looked at the definition of "dissector_try_heuristic()", I don't see anything that would lead me to the code where the T.38 heuristic dissector is called.

I also don't see any code that tests if a payload should be decoded as "T.38" in packet-t38.c.

This is my long way of asking, where can I find the code that tests if the payload is T.38, for both UDP and RTP packets?

Thank you.

Regards,

Rayne