Wireshark-dev: [Wireshark-dev] Introduction and first questions/suggestions
From: Simon Ginsburg <[email protected]>
Date: Wed, 4 Apr 2007 14:20:59 +0200

since I signed up this list just recently, I take the opportunity to introduce myself. My full name is Dr. Simon Ginsburg and I'm Product Manager for communication protocols/products for the company Saia- Burgess Controls Ltd in Switzerland. This is the company, where my college Christian Durrer has already written a dissector included in Wireshark for our proprietary field bus called "S-Bus".
One of my main fields of activity currently is the implementation of  
the BACnet protocol into our PLC (Programmable Logic Controllers).  
For testing, training, support and training purposes I frequently use  
Wireshark and also tell our customers with technical problems in the  
field to send my not only their project but also trace logs usually  
taken with Wireshark.
During recent support call treatments I discovered some fields of  
improvements. Before I adding them to the long list of whishes or in  
the Wikipedia, I wanted to check that I have not overlooked something.

Either under Chapter "GUI" or "Dissection":
When a protocol is used on another port than Wireshark expects it to be (such as BACnet on UDP port 48560) the context sensitive menu Item "Decode as..." is GREAT, but finding what I need is not so great since only an abreviation (in above example BVLC) can be selected without any way of help. I suggest a tooltip when hovering over a selected protocol item with the same content as in help --> Supported Protocols (in above example BVLC: BACnet Virtual Link Control).
Dissector specific
Item 19. What's the reason, the APDU part of BACnet/IP is not dissected? Is it just the workload (for which a solution can be found) or there a technical reason such as variable length, the BACnet specific solution of segmenting or other?
BACnet is not easy to find. IMHO it's also a member of the "FieldbusProtocolFamily" as is LON and EIB, the first using "IP-852", the latter EIBnet/IP for the transport over IP. Is it OK that I extend the Wiki pages accordingly?