Wireshark-bugs: [Wireshark-bugs] [Bug 2452] Ports incorrectly decoded as DPLAY instead of RTP
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 11 Apr 2008 21:57:34 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2452





--- Comment #1 from Jaap Keuter <jaap.keuter@xxxxxxxxx>  2008-04-11 21:57:33 GMT ---
This has nothing to do with the port numbers since this dissector is
heuristicaly added to UDP (and TCP). 
The sample capture shows "DPlay player to player message", which follow from
this somewhat poor heuristic:

    /* There is a player to player message that does not contain "play" */
    token = tvb_get_letohl(tvb, 0);
    token = (token & 0xfff00000) >> 20;
    if (token == 0xfab || token == 0xbab || token == 0xcab) {
        dissect_dplay_player_msg(tvb, pinfo, tree);
        return TRUE;
    }

The RTP sequence number just match these tokens.


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.