On Dec 20, 2013, at 12:03 AM, Alexis La Goutte <[email protected]> wrote:
> Do you have a packet of Joerg ? No, but I asked Joerg if he still has one. > Because in the screenshot, there is "Magic Value" may be the value is > different.... It might be, but I wouldn't be surprised to find that the magic number is the same (in which case we can make this a heuristic dissector, so you don't have to specify the port number). *If* the magic numbers are the same, the header version is different in the two versions, and the header length is 20 in Joerg's captures, *then* they share a common header, and the header length is *probably* fixed for each version. > (there is also a type field may be the other field is different if type have > other value) Or maybe the type field isn't even present in the other version. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
