Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9469] New: Patch: set dissector for a specific source+dest port combination

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	9469
Summary	Patch: set dissector for a specific source+dest port combination
Classification	Unclassified
Product	Wireshark
Version	1.11.x (Experimental)
Hardware	All
OS	All
Status	UNCONFIRMED
Severity	Enhancement
Priority	Low
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	deonvdw@gmail.com
Attachment #12148 Flags	review_for_checkin?

Created attachment 12148 [details]
Patch to add "conversation" to decode-as menu

Build Information:
Build Information:
wireshark 1.11.1 (SVN Rev Unknown from unknown)

Copyright 1998-2013 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GTK+ 3.4.4, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.32.4, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.1, without Python, with GnuTLS 2.12.18, with Gcrypt 1.4.6,
with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Nov 18 2013),
with AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.3
(packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.12.18, Gcrypt 1.4.6, without AirPcap.
        Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz, with 511MB of physical memory.


Built using Microsoft Visual C++ 10.0 build 40219
--
This patch adds a new entry ("conversation") in the decode-as dialog for TCP
and UDP which applies the selected dissector to packets between the source and
destination ports. The "conversation" entry has "AND" logic where the existing
"both" entry has "OR" logic.

My use case for this is a situation where a server can speak multiple protocols
on a single port and a single dissector cannot correctly determine which
protocol is in use (e.g. if initial handshake is not captured).

Developed against 1.11.2 source.

---

      You are receiving this mail because:

• You are watching all bug changes.