Known SIP headers without an optional whitespace after the colon have the
first character truncated in the decode.
Via:SIP/2.0/UDP 10.10.10.10:5060
displays as:
Via: IP/2.0/UDP 10.10.10.10:5060
Below is my patch to fix the problem.
-steve
*** packet-sip.c.old 2003-03-10 19:50:36.000000000 -0600
--- packet-sip.c 2003-05-28 22:14:15.000000000 -0500
***************
*** 17,23 ****
* Copyright 2000, Heikki Vatiainen <hessu@xxxxxxxxx>
* Copyright 2001, Jean-Francois Mule <jfm@xxxxxxxxxxxxx>
*
! * $Id: packet-sip.c,v 1.35 2003/03/11 01:48:55 gerald Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@xxxxxxxxxxxx>
--- 17,23 ----
* Copyright 2000, Heikki Vatiainen <hessu@xxxxxxxxx>
* Copyright 2001, Jean-Francois Mule <jfm@xxxxxxxxxxxxx>
*
! * $Id: packet-sip.c,v 1.35 xx 2003/03/11 01:48:55 gerald Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@xxxxxxxxxxxx>
***************
*** 330,338 ****
--- 330,344 ----
tvb_format_text(tvb, offset,
eol));
}
else {
+ if (tvb_find_guint8(tvb, offset + header_len +
1, 1, ' ') == -1) {
+ proto_tree_add_string(hdr_tree,
hf_header_array[hf_index], tvb, offset, next_offset - offset ,
+ tvb_format_text(tvb,
offset + header_len + 1, eol - header_len - 1));
+ }
+ else { /* eat leading whitespace */
proto_tree_add_string(hdr_tree,
hf_header_array[hf_index], tvb, offset, next_offset - offset ,
tvb_format_text(tvb,
offset + header_len + 2, eol - header_len - 2));
}
+ }
offset = next_offset;
}