Wireshark · Ethereal-dev: [Ethereal-dev] Why "decode as" have no DCERPC?

[scz <scz@xxxxxxxxxxx>]

I had captured some V4 DCERPC packets using ethereal 0.10.14, 
one of those is conv_who_are_you2, it's frame 2:

1 122 MGMT   10.10.7.2  10.10.7.44 4717 1027 rpc__mgmt_inq_if_ids request
2 142 UDP    10.10.7.44 10.10.7.2  2536 4717 Source port: 2536  Destination port: 4717
3 146 UDP    10.10.7.2  10.10.7.44 4717 2536 Source port: 4717  Destination port: 2536
4 122 DCERPC 10.10.7.44 10.10.7.2  2536 4717 Ack: seq: 0
5 450 MGMT   10.10.7.44 10.10.7.2  1027 4717 rpc__mgmt_inq_if_ids response
6 122 DCERPC 10.10.7.2  10.10.7.44 4717 1027 Ack: seq: 0 [req: #1]

but I can't get CONV, ethereal 0.10.14 don't decode it. The packet-dcerpc-conv.c
seems correct.

So I choose "decode as", but DCERPC and/or CONV isn't there.

Why "decode as" have no DCERPC?

----