https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6373
--- Comment #13 from Yaniv Kaul <mykaul@xxxxxxxxx> 2011-09-28 12:37:05 PDT ---
(In reply to comment #11)
> (In reply to comment #9)
> > 3. Fix VNC dissector, that even if it's registered on that port, it won't grab
> > it if it can't find VNC traffic?! 'Un-register' it in that case? not sure how
> > to do it exactly.
>
> The VNC dissector can run into difficulties determining if a packet on port
> 5900 really belongs to VNC, especially when the capture session started after
> the VNC connection began, because of the way the protocol was designed.
> Wireshark works best when every packet has everything necessary to decode it
> entirely. VNC instead assumes that everything before the current packet was
> already seen and kept track of.
Right, it has the state information between the client and the server - which
is exactly why if the VNC dissector failed to find the start of the connection,
it should give up, as perhaps it's not VNC at all.
BTW, the Spice protocol behaves in an identical manner.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
