On Sat, Nov 29, 2003 at 04:31:47AM -0800, john g wrote:
> "Follow TCP Stream" for http:
>
> the content of http stream is displayed encoded (guess
> here),
Only if the data in the stream is itself encoded. For non-encoded HTTP
streams, i.e. streams where the TCP segments contain text, the content
of the stream is displayed as text.
> Next to the "Follow TCP Stream" is "Decode As". where
> and for which type of protocols would one use decode
> as ?
One would mainly use it for protocols that
1) don't have standard TCP or UDP port numbers or that do but
don't happen to be using those ports;
2) don't have heuristic dissectors;
3) haven't been assigned to particular conversations by virtue
of earlier packets in the capture.
> please give an example where one would use the Decode as.
One might use it for RTP/RTCP traffic if earlier RTSP or SIP/SDP traffic
weren't present in the capture to let Ethereal know what port numbers
would be used for that RTP/RTCP traffic.
