Hi
I work with sctp pcaps very often and I have always found that Wireshark doesn't handle them in a practical way
The far biggest issue is the display filter logic
As a workaround, I have to externally pre-process the traces and "de-chunk" the sctp packets: when every sctp packet contains only one chunk everything works like a charm, as usual
From a user point of view, I would like an improvement in the display filters:
* you should be able to match a specific sub-packet. I mean, when the filter is something like "sccp.xxx == AAAA && gsm_a.yyyy == BBBB" I do expect the matched fields to be on the same sub-packet, not on different chunks of the same sctp packet. AFAIK one way to achieve this goal is forcing all protocol fields above sctp (or any other "aggregating" protocol) to be per sub-packets, not per packets (as today). In this way, there shouldn't be multiple fields anymore
* when there is a display filter (involving sub-protocol fields), only matching sub-packets should be visualized in the packet list
* you should be able to export only visualized sub-packets in a valid file.
Just my 2 cents, based on my personal workflow
I fully understand that my wish-list requires a huge amount of work; improving only the visual representation of the packets/sub-packet should be an important step forward anyway
I don't have the expertize to write GUI or "core" code, but I am more than willing to test any solutions
Thank you very much for bringing up this topic
Ivan
