Wireshark-dev: Re: [Wireshark-dev] Dissector for H1 protocol not called
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>
Date: Sat, 22 Jul 2006 03:07:47 +0000
thanks,
checked in


it would be nice with example captures on the wiki for H1 and SKINNY



On 7/21/06, Jeff Morriss <jeff.morriss@xxxxxxxxxxx> wrote:


Hi list,

Thomas Boehne wrote:
> On Thursday 20 July 2006 12:06, Jeff Morriss wrote:
>> If I set the TCP preference "Try heuristic dissectors first?" then the
>> "nok" file shows up as H1 for me.
>
> This works for me too, thanks!
>
>> The "nok" file has a TCP segment between ports 1030 and 2000.  Looking
in:
>>
>> http://www.iana.org/assignments/port-numbers
>>
>> we can see that port 2000 is registered to "Cisco SCCP" which Wireshark
>> has a dissector for (it's called "Skinny" in Wireshark).  Sure enough,
>> "packet-skinny.c" is not a new style dissector (it returns void), so
>> it's what's eating your packet.

The attached patch makes the Skinny dissector "new style".  Please
consider it for inclusion.