On Mar 14, 2014, at 5:06 PM, Bill Meier <wmeier@xxxxxxxxxxx> wrote:
>
> Re;
>
>> doc/README.heuristic | 10 +--
>
>
> + * but ONLY do this if your heuristic sits directly on top of UDP
> or TCP (ie, you did heur_dissector
> + * otherwise you'll be overriding the dissector that called your
> heuristic dissector.
>
>
> I think this is not correct. There is at least one "transport" protocol other than TCP & UDP (i.e., DCCP) which currently has a heuristic table and calls 'try_conversation()' and thus heuristic sub-dissectors can use conversation_set_dissector().
Right - sorry, I was being too specific.
> How about the something like following wording:
>
> ... but only do this if your heuristic sits directly on top of
> (was called by) a dissector which established a conversation
> for the protocol "port type". IOW: directly over TCP, UDP, ...
>
Sounds good. I'll submit it shortly if no one objects.
-hadriel
