Wireshark · Ethereal-dev: Re: [Ethereal-dev] PPIDs in packet_info

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Michael Tuexen wrote:

> Dear all,
>
> I want to add SCTP support in the 'Decode as' dialog. The src/dst
> port stuff os easy to handle, because you know the src/dst port
> of of the selected packet from the packet_info structure.
>
> For SCTP it would also be very helpful to change the dissector
> for the PPID field included in every DATA chunk. But there can
> be more than 1 DATA chunk in one SCTP packet. How can I know
> in the 'decode as' code, which PPIDs are present in the packet?
> One possibility is to add an array of PPIDs to the packet_info
> structure and fill that in the SCTP dissector. This would give
> the information for the first N DATA chunks. A large N would
> require a lot of memory, but, let us say N = 4, would be a compromise.
> So is this acceptable, or is there even a better solution to the
> problem?

I frequently see more than 4 DATA chunks in a single packet BUT those 
chunks always have the same PPID.  (Do any of the SIGTRAN protocols 
allow sharing an association between 2 or more of them?  I doubt it but 
I'm not sure.)