Wireshark · Ethereal-dev: Re: [ethereal-dev] RPC dissector

[Uwe Girlich <Uwe.Girlich@xxxxxxxxxxx>]

How to find a conversation if the client port changes?
... stuff deleted

> ...or perhaps both port numbers should be PT_NONE, so that the
> conversation keeps track solely of the client and server IP addresses,
> to handle protocols other than portmapper/rpcbind and NFS where the port
> number might change across a reboot.
To find retransmissions over a reboot of the server is impossible, because the
client has to run into a time out first. It goes up one level and asks the
portmapper for the new port number. Then it goes down again and uses a
new XID.

{
restart:
	ask portmapper
	prepare packet (select a new XID)
	{
		send request
		wait for reply
		if timeout goto restart
		handle reply
	}
}