Wireshark · Ethereal-dev: Re: [Ethereal-dev] RFC1006

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Sun, Mar 25, 2001 at 12:06:13PM -0600, Martin Thomas wrote:
> Enclosed is a new dissector for RFC1006. Andreas Sikkema wrote the tpkt
> dissector that this is based upon but that was only called from the Q.931
> dissector..

Well, the best way to handle this is, I think, to have a common routine,
used by the Q.931 dissector as well as the RFC 1006 TPKT dissector,
which dissects a TPKT header and returns the frame length.

As such, I've renamed the old TPKT dissector to "dissect_tpkt_header()",
and wrote a "dissect_tpkt()" that calls it, constructs a new tvbuff
using the length it returns, and then calls the OSI transport protocol
dissector; the latter dissector registers itself to be used for TCP port
102.

I've also enabled the code to heuristically check for
Q.931-wrapped-inside-TPKT-over-TCP, so it's present in standard
Ethereal, rather than requiring that H323 be defined; defining H323 now
just enables the hooks for Andreas' H.225 stuff.