Wireshark · Ethereal-users: Re: [Ethereal-users] msproxy protocol

[Guy Harris <guy@xxxxxxxxxx>]

On Fri, Jun 07, 2002 at 02:42:06PM -0700, Ed Sawicki wrote:
> I agree. However, in  this case, we have a UDP packet with source
> port 1745 and destination port 53. Ethereal incorrectly assumes port
> 1745 is the real protocol when port 53 is more likely to be correct.
> A well-known port (1-1023) should always trump a registered port (1024
> an up). This is far more likely to be correct more of the time than the
> reverse.

I checked in a change to have the TCP, UDP, and SCTP dissectors try the
lower-numbered port first and the higher-numbered port second.

> By the way, why does the IANA list call port 1745 remote-winsock?

I don't maintain that list, so I have no idea.