Wireshark · Ethereal-dev: Re: [ethereal-dev] wiretap request - if it's not too muchtrouble

[John McDermott <jjm@xxxxxxxxxx>]

Diana,
[Hi, there!]  

"Eichert, Diana" wrote:

> there was alot of ip traffic using at tcp port 6004, which i knew was a VNC
> server, anyone familiar with VNC?

The protocol is called RFB and is documented at
http://www.uk.research.att.com/vnc/protocol.html.  It does not look too
complicated as protocols go.  It looks as thought there is enough there
(including a .h in PDF format!?!) to write the decoder...

General question:
My VNC has always used port numbers in the 5900 and 5800 series (58xx or
59xx where xx is the display number) and sometimes 53xx if waiting for
connections.  Normally 6000 and the ports just above it are X displays
(6000-6063 per the list of assigned ports at iana).   I'm not sure how
to code this.  If we had a protocol which did not have an assigned port
or which was not at its assigned place, should we have a way to tell
Ethereal about it?  (BTW, I just checked and 58xx and 59xx are not
allocated.) Would the plug-in stuff be the right place?

> thanks
> 
> diana
> 
--john
-- 
John McDermott jjm@xxxxxxxxxx
Writer and Computer Consultant
J-K International, Ltd.
+1 505/377-6293 - V
+1 505/377-6313 - F