On Wed, Jan 08, 2003 at 02:24:13PM +0100, David Vryghem wrote:
> Ethereal decodes the port 647 used for these communications as
> "qdhcp_failover", which seems to be nice.
That's because it uses "getservbyport()" to use the OS's mechanisms to
map port names to port numbers and vice versa. That doesn't imply that
Ethereal itself knows anything about that protocol.
> Nevertheless the packets are decoded in a "UDP format",
Not surprising, if the protocol runs over UDP.
> 1) Does anyone know if there is a way for ethereal to decode those
> packets not as UDP packets but as DHCP failover protocol packets so that
> I can see the failover information carried by the packet?
The only way for it to decode it would be if somebody wrote a dissector
for it and added it to Ethereal. It currently has no such dissector.
> 2) If not,
> 2.1) Do you know if there is any simple way to do this?
Well, that depends on what you consider "simple". In the Ethereal
source tree, in the "doc" directory, are some "README" files that give
some information on how to write dissectors.
> 2.2) Do you know if this is planned to be developped in ethereal?
http://www.ethereal.com/faq.html#q1.3
