Ethereal-dev: Re: [ethereal-dev] Dissector for the Session Announcement Protocol (SAP)
> Is there some problem with Ethereal dissecting packets to port 9875 as
> SAP packets if they're not sent to the appropriate multicast address?
> E.g., should unicast packets to 9875, or multicast packets not sent to
> the appropriate multicast addresses, be dissected as some other type of
> packet?
The SAP draft divides the announcements to global scope and
administrative scoped announcements. The global scope announcement
will go to 224.2.127.254 aka. sap.mcast.net and administratively
scoped announcements will go to the highest address in the scope
the advertised session belongs to. The block allocated to the
administratively scoped addresses is 239.0.0.0/8.
Since Ethereal can not easily know what the administrative address
scope boundaries are, it might sometimes dissect something as SAP
that really isn't, but I guess that's the problem with packet
sniffing in general.
If you were thinking are there any other multicast targeted
protocols that also use port 9875, then I do now know if they
exist. I did a grep through RFCs and Internet-Drafts and found
none, so I guess that it is ok to think SAP == port 9875. I'm not
a multicast expert, so I may very well be wrong.
The SAP draft says that the SAP packets are sent to a multicast
addresses. This is why I am interested in passing the packet to the
SAP dissector only if it was sent to a multicast address.
// Heikki
--
Heikki Vatiainen * hessu@xxxxxxxxx
Tampere University of Technology * Tampere, Finland
