Wireshark-dev: Re: [Wireshark-dev] RTCP Heuristic decoder
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: vinayak kamath <vins.sunysb@xxxxxxxxx>
Date: Fri, 11 Sep 2009 13:12:57 -0700


On Fri, Sep 11, 2009 at 11:28 AM, Bill Meier <wmeier@xxxxxxxxxxx> wrote:
> On Thu, Sep 10, 2009 at 4:59 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
>
>> On Sep 10, 2009, at 4:30 PM, vinayak kamath wrote:
>>
>>> We have our own custom decoder for a tweaked version of RTCP protocol.
>>> Heres the code snippet where in we say anything on this udp.port
>>> send the message to custom decoder.
>>> ##########################################################
>>> if(!TWS_PortList("FOO", configFile, (int*)portList, MAXPORTS))
>>>       {
>>>         while (count < MAXPORTS && portList[count]!=0)
>>>         {
>>>             dissector_add("udp.port", portList[count], foo_handle);
>>>             count++;
>>>         }
>>>       }
>>> ##########################################################
>>>
>>> But still wireshark decodes it as RTCP rather than FOO.
>> The dissector to which foo_handle refers is a non-heuristic dissector;
>> if RTCP's "Try to decode RTCP outside of conversations" preference is
>> set, the heuristic RTCP dissector will try to recognize RTCP packets.
>>
>> If UDP's "Try heuristic sub-dissectors first" preference is set, the
>> UDP dissector will try heuristic dissectors before trying non-
>> heuristic dissectors; that means that if the RTCP dissector recognizes
>> packets for your tweaked protocol, it will dissect those packets and
>> your dissector will not be given a chance to dissect them.  If that
>> preference is set, try unsetting it.



vinayak kamath wrote:
 > Thanks  .
 > But in preferences i don't have "Try to decode RTCP outside of
 > conversations" preference set. Even then it decodes as RTCP rather
than FOO.
 > Is there any way for custom dissector taking precedence over
heuristic RTCP
 > dissector??
 >
 > Thanks
 > vinayak
 >

Have you also cleared the following as indicated in Guy's reply??

     Yes even "Try heuristic sub-dissectors first" preference is not set . Even then it decodes as RTCP & not FOO..
 
 > If UDP's "Try heuristic sub-dissectors first" preference is set, the
 > UDP dissector will try heuristic dissectors before trying non-
 > heuristic dissectors
 >

PS: Please don't "top-post". :)
 The EMail history gets very confusing.

See http://www.html-faq.com/etiquette/?toppost


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe