On Jan 31, 2007, at 8:13 PM, Shehjar Tikoo wrote:
I am writing a RPC over TCP heuristic dissector
What do you mean by "a RPC over TCP heuristic dissector"?
If you mean a dissector for ONC RPC running over TCP, which is a
heuristic dissector (as there is no standard set of ports for ONC RPC,
other than 111 for the portmapper/rpcbind and 2049 for NFS), why not
modify the existing one to do what you need? Having two heuristic
dissectors for the *same* protocol makes no sense whatsoever; either
modify one to do what you need, or build a special private version of
Wireshark with your dissector replacing the standard one.
