While fixing bug 6779, I noticed in some of my captures that the CHAP-Password
was being displayed by Wireshark as a single 17-byte field; however, my reading
of http://tools.ietf.org/html/rfc2865#section-5.3 tells me that it should be
displayed as a 1-byte "CHAP Ident" field followed by a 16-byte String.
dictionary.rfc2865 lists the CHAP-Password as:
ATTRIBUTE CHAP-Password 3 octets
I suppose the solution is to change the "octets" to "something else" then add
support for parsing that "something else"? I find the following types in the
various dictionaries, none of which would seem to fit here:
abinary
byte
combo-ip
date
ether
ifid
integer
ipaddr
ipv6addr
ipv6prefix
octets
short
signed
string
tlv
Any recommendation for what to call this new type? Also, I'm not familiar with
the dictionary parsing steps - any pointers there? Is this even the right
approach?
Thanks.
- Chris
