Wireshark
the world's foremost network protocol analyzer
Wireshark-dev: [Wireshark-dev] how recognise a udp packet data part is sip packet?
From: <zhangchuangde@xxxxxxxxxxxxxxx>
Date: Tue, 2 Jun 2009 17:44:45 +0800
hi,
as the define in packet-sip.c
as the define in packet-sip.c
#define TCP_PORT_SIP 5060
#define UDP_PORT_SIP 5060
#define TLS_PORT_SIP 5061
#define UDP_PORT_SIP 5060
#define TLS_PORT_SIP 5061
I know when a tcp/udp/tls packet's port is
5060/5061, the protocol analyzer will dissect it into sip protocol.
however, as the first packet in the accessory, its src port is 6304 and dst port is 6090, and this packet is
also dissected into sip protocol.how wireshark know this packet is a sip packet?
can you tell me how and why? thanks a
lot!
Best Regards,
Ade Zhang
Attachment:
sip_port.pcap
Description: sip_port.pcap
- Follow-Ups:
- Prev by Date: Re: [Wireshark-dev] Ubuntu buildbot error
- Next by Date: [Wireshark-dev] Help decrypting 802.1x PEAP Traffic
- Previous by thread: Re: [Wireshark-dev] Modifying port number for TFTP
- Next by thread: [Wireshark-dev] 答复: how recognise a udp packet data part is sip packet?
- Index(es):