Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Unexpected tap behaviour

From: Anders Broman <a.broman@xxxxxxxxxxxx>
Date: Mon, 20 May 2013 23:30:55 +0200
Jeff Morriss skrev 2013-05-20 21:35:
On 05/20/2013 02:36 PM, Anders Broman wrote:
Hi,
I just implemented the export_pdu tap for Diameter as well as SIP to my
surprise if I don't define
a filter only SIP packets get experted from a file with both Diameter
and SIP. If I specify a filter of
"diameter or SIP" both gets exported. I would have expected both to be
exported with no filter. Could any one shed
some light on what's going on?

Diameter isn't queuing messages to the tap when !tree. Need to either lose this line in dissect_diameter_common():

   1082         if (!tree) return;

or move the tap queuing before it.

Doh, should have thought about that. Will look into it tomorrow.
Thanks
Anders
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe