Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: [PATCH] Well known port number for outgoing traffic ? [Was: Order of subdisse

[Guy Harris <gharris@xxxxxxxxx>]

On Sat, Jun 05, 2004 at 04:39:11PM +0200, metatech wrote:
> There should be two tables :
> - "tcp.port" when the well known port number is used to receive connections.
> - "tcp.cport" when the well known port number is used by the client to 
> initiate a connection.
> All dissectors (FTP, ...) that use a well known port number to initiate a 
> connection should be modified.
> If the SYN was seen in the conversation, the TCP dissector should call 
> dissector_try_port() twice :
> - Once for the "tcp.port" table.
> - If the first call failed to find a match, a second time for the 
> "tcp.cport" table.

I had the same idea - you might want to call it "tcp.client_port" rather
than "tcp.cport".

> Which other protocols do use this well known port number for client flow 
> (the IANA list does not mention that either)

FTP is a bit of an odd protocol, with the separate control and data
ports, so there might not be many others.