Hi, I'm not intierly sure how this is supposed to work but my understanding is that one of the heuristic Conditions is that the "fp structure" is filled in/attatched to the packet.
Does the code filling in this structure know the IP address and port pair going to be used for the UDP transport? If so that code could set up a conversation and set the UDP conversation dissector. That means that for that UDP IP and port par "dissect_fp..() would be called directly not the heuristic. I asume that any IP payload traffic carried inside of this UDP reaffic would have other IP address port combinations? With this setup there is no need for a FP heuristic dissector at all. As for thye other question regarding the trace attached to the bug is there enough iformation in the (NBAP?) Message(s) to fill in the fp struct if so code to do that could be added to the NBAP dissector + setting up of a conversation. Regards Anders -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Tobias Witek Sent: den 11 november 2009 11:33 To: [email protected] Subject: [Wireshark-dev] Dissecting UDP conversations that encapsulate UDPdata Hello, I am currently trying to extend the UMTS FP protocol to also handle FP frames sent via UDP. To avoid modifications in the UDP dissector, my plan was to use a heuristic to detect the first UDP packet of each stream that contains FP and assign a conversation dissector to the whole conversation. The problem is that these frames can in turn contain UDP (e.g. DNS queries). The solution outlined above would dissect these as FP again, if I understand correctly (as a separate conversation). As far as I see, I would need a way to let the heuristic determine that the current frame was already parsed as FP (respectively, is already part of a different UDP conversation) and should not be treated as FP. Currently, I see no way to do this and would be very happy about any suggestions! Regards, Tobias ________________________________________________________________________ ___ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
