Wireshark-dev: Re: [Wireshark-dev] Decode As... Questions
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 30 Apr 2008 16:46:11 -0700
On Apr 30, 2008, at 11:05 AM, Peter Fuller wrote:


In the past, I have come across some data that was one transport
layer carried in another (TCP carrying UDP).

I.e., a byte stream containing a sequence of UDP header+payload  
items?  (The UDP header contains a length, so that can be done without  
requiring a protocol in between TCP and UDP as an adaptation layer.)

Is there a reason that the transport layers are not
included in the 'Decode As...'  list ?

Because nobody's made the transport layers register themselves as  
belonging in that list.  It might be possible to make UDP do so, *if*  
the IP endpoint addresses of the encapsulated UDP packets are the same  
as the IP endpoint addresses of the TCP connection (otherwise, there  
needs to be a protocol in between TCP and UDP to provide those  
addresses).