Wireshark-bugs: [Wireshark-bugs] [Bug 4721] Want to be able to apply decode as to Data Portion o
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4721

Sake <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|WONTFIX                     |

--- Comment #5 from Sake <[email protected]> 2010-05-07 23:52:30 PDT ---
It looks like it is just a GUI problem, the decode as functionality does work
for ethertype 0x0000 and 0xffff:

macsake:Downloads sake$ tshark -c 10 -r roger.pcap -d ethertype==65535,ip -d
ethertype==0,ip
  1   0.000000 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0000)
  2   0.000033 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=1461 Win=32768 Len=0
  3   0.007917 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0000)
  4   0.015817 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0000)
  5   0.015836 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=4381 Win=32768 Len=0
  6   0.023728 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0050)
  7   0.028336 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=5841 Win=32403 Len=0
  8   0.033801 156.124.71.207 -> 156.124.42.84 TCP scoremgr > wcpp [PSH, ACK]
Seq=1 Ack=1 Win=14766 Len=90
  9   0.033804 156.124.26.201 -> 156.124.71.207 NCP Unknown type (0x0020)
 10   0.033825 156.124.71.207 -> 156.124.26.201 TCP 5511 > ncp [ACK] Seq=1
Ack=7301 Win=32768 Len=0
macsake:Downloads sake$ 

(don't be misled by the "Unknown type (0x0000)", they are produced by the NCP
dissector, the frames are indeed dissected as IP)

So I guess there is a little bug in the code that decides whether "Decode
As..." should be greyed out or not. I'll have a look...

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.