Wireshark · Ethereal-dev: Re: [Ethereal-dev] SCTP analysis (similar to tcp.analysis stuff)

[Guy Harris <gharris@xxxxxxxxx>]

Jeff Morriss wrote:

> Has anyone ever thought about adding the kind of advanced sequence 
> number analysis that the TCP dissector has to SCTP (detecting 
> retransmissions, duplicate ACKs, etc.)?
>
> In TCP it's done inside the dissector (which allows cool things like 
> jumping do the frame with the duplicate ack) but is that how it should 
> be done now

I'd say so.  (Note that the sequence number analysis was added by the 
person who invented the tap mechanism. :-))

> or would a tap be better?

*Possibly*, although, as the tap code would be part of the same source 
base as the dissector code, I'm not sure there's a compelling reason to 
do it in a tap - it's not as if it'd be a third-party add-on.