Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 5718] IPP : malformed packages

Date: Sat, 26 Feb 2011 14:52:14 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5718

--- Comment #5 from Bill Meier <wmeier@xxxxxxxxxxx> 2011-02-26 17:52:12 EST ---
(In reply to comment #4)
> Well, this is wonderfully annoying.
> 
> I think I have some traces where HTTP traffic to and from port 631 is IPP
> traffic but does *NOT* have a Content-Type of application/ipp.
> 
> This is a trace where some HTTP traffic to and from port 631 is IPP traffic,
> with a Content-Type of application/ipp, and other traffic isn't.
> 

I noticed the same thing as I looked at various other Wireshark IPP captures.

I started to wonder if the right solution might be to register port 631 (IPP)
only for HTTP and let the Content-Type determine the sub-dissector called
(including IPP).

Based on looking at the RFP it seems that IPP is always transported over HTTP.

What do you think ?

I was going to do a bit more research to learn about the CUPs server and how it
works but I haven't yet done so....

One question I have is whether CUPS also normally uses port 631 for non-HTTP
traffic. The original capture attached to this bug suggests that it might.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.