Wireshark · Ethereal-dev: [Ethereal-dev] Any chance to get something like "decode as" for DCE-RPC interfaces?

[Ulf Lamping <ulf.lamping@xxxxxx>]

Hi List!

I have an ongoing problem with DCE-RPC (DCOM) calls.

If I couldn't get the context of a DCE-RPC call (because I've missed the 
"bind" or "alter context" packets), Ethereal can't get a match between 
the conversation and the corresponding DCE-RPC call dissection.

It would be *very nice* to have the "Decode As" feature for DCE-RPC 
interfaces, so the user could select a specific RPC interface for a 
specific conversation.

Had a short look into the decode as dialog, but as I'm not really 
familiar with the dissection engine, I don't see an easy way to add this 
feature.

Anyone interested in implementing such a feature, or at least give an 
estimation how much effort it would be to implement it and how?

Regards, ULFL