Wireshark-dev: Re: [Wireshark-dev] Overriding existing RPC-TCP heuristic dissector with another heuristic one

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 1 Feb 2007 16:10:19 -0800

On Jan 31, 2007, at 8:13 PM, Shehjar Tikoo wrote:

I am writing a RPC over TCP heuristic dissector

What do you mean by "a RPC over TCP heuristic dissector"?

If you mean a dissector for ONC RPC running over TCP, which is a heuristic dissector (as there is no standard set of ports for ONC RPC, other than 111 for the portmapper/rpcbind and 2049 for NFS), why not modify the existing one to do what you need? Having two heuristic dissectors for the *same* protocol makes no sense whatsoever; either modify one to do what you need, or build a special private version of Wireshark with your dissector replacing the standard one.