ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Decode As... Questions

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 30 Apr 2008 16:46:11 -0700

On Apr 30, 2008, at 11:05 AM, Peter Fuller wrote:


In the past, I have come across some data that was one transport
layer carried in another (TCP carrying UDP).

I.e., a byte stream containing a sequence of UDP header+payload items? (The UDP header contains a length, so that can be done without requiring a protocol in between TCP and UDP as an adaptation layer.)

Is there a reason that the transport layers are not
included in the 'Decode As...'  list ?

Because nobody's made the transport layers register themselves as belonging in that list. It might be possible to make UDP do so, *if* the IP endpoint addresses of the encapsulated UDP packets are the same as the IP endpoint addresses of the TCP connection (otherwise, there needs to be a protocol in between TCP and UDP to provide those addresses).