Wireshark-dev: [Wireshark-dev] SIP heuristics

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 7 Jun 2006 15:32:25 +0200 (CEST)

Hi,

Now that the dust is settling (until the user community comes barging in
;) let us slowly get back to the real stuff.

I've got trouble with SIP heuristics. Currently it tries to see if the
packet contains what looks like a few tokens, which are checked to certain
criteria. The trouble is that I've got SIP lines packed up in other
(binary coded) protocols, which do contain NULL characters. Still the SIP
heuristics take that as being part of the request line...... That can't be
right, can it? Shouldn't the heuristics take the UDP/TCP payload and take
the _zero terminated_ string in there to determine if it is a SIP packet
after all?

Your thoughts please,
Jaap