Wireshark-users: Re: [Wireshark-users] A simple question about Wireshark: confusion about OICQ

From: "Adele" <jl007@xxxxxxxxxxxxxx>
Date: Fri, 6 Mar 2009 10:55:57 -0800

Dear Olivier,

Thanks a lot for your help. 
But I am really confused here. If it is like what you said that as long as a
packet's UDP port is 8000, Wireshark will recognize it as a OICQ packet.
Then anyone can send UDP packets and assign 8000 as the port number. So all
these UDP packets will be recognized as OICQ packets? Is this a little bit
too easy for recognizing a packet, and also too easy for others to 'cheat'?

Also, if it is possible, may I ask where I can find the source code about
how to recognize protocols? Is this part open sourced?

Thanks a lot for your help and best regards.

Adele JIA