Wireshark-users: Re: [Wireshark-users] DCERPC over TCP
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andrej van der Zee <andrejvanderzee@xxxxxxxxx>
Date: Tue, 27 Dec 2011 23:34:08 +0100
>> Shouldn't the heuristic sub-dissector for DCERPC be favored over the
>> port-registered GTP dissector?
>
> *If* "Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port" is set for TCP, yes, it should be.

Indeed, this TCP-option was switched off. After switching it on, it
works as expected. Thanks for pointing this out.

Cheers,
Andrej