Ethereal-users: Re: [Ethereal-users] Dissectors available in 'Decode as' feature

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 21 May 2002 12:46:47 -0700
On Tue, May 21, 2002 at 04:37:58PM +0200, Jean-Baptiste Marchand wrote:
> However, the source port is 1065 and the conversation is identified as
> MAPI protocol. I tried to choose the dcerpc dissector under 'Decode as'
> but it is not available.
> 
> Why are there only a subset of available dissectors in the 'Decode as'
> dialog box ? Is it because some dissectors are too complex to be used on
> the fly ?

No, it's because some of them are "heuristic" dissectors, which have a
different calling sequence and cannot work with the "Decode As"
mechanism.

Given that MAPI is a DCE RPC-based protocol, and given that the MAPI
dissector doesn't actually dissect anything, perhaps the MAPI dissector
should simply be removed from Ethereal, now that we have a DCE RPC
dissector.

For now, try disabling the MAPI dissector - select "Protocols" from the
"Edit" menu, click on the "mapi" button (you may have to scroll to find
that button), and click the "OK" button.