Ethereal-dev: Re: [Ethereal-dev] add "/Capture/Stop" menu item

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Sun, 15 Oct 2000 20:24:56 -0700
On Thu, Oct 12, 2000 at 11:42:44AM +0200, andreas.sikkema@xxxxxxxxxxx wrote:
> > SSH traffic is likely to look like random bytes; I suspect the
> > heuristics for Q.931 aren't strong enough to filter out that random
> > traffic.
> 
> Probably yes, the current Q.931 heuristics are very basic.

...and are even *more* basic if H323 isn't defined, i.e. it doesn't even
bother checking the protocol discriminator if it isn't defined.

Given that, either the heuristic dissector presumably be registered
unless H323 is defined, or at least some of the tests done if the
dissector is heuristic should be done even if H323 isn't defined.