Dear Olivier,
Thanks a lot for your help.
But I am really confused here. If it is like what you said that as long as a
packet's UDP port is 8000, Wireshark will recognize it as a OICQ packet.
Then anyone can send UDP packets and assign 8000 as the port number. So all
these UDP packets will be recognized as OICQ packets? Is this a little bit
too easy for recognizing a packet, and also too easy for others to 'cheat'?
Also, if it is possible, may I ask where I can find the source code about
how to recognize protocols? Is this part open sourced?
Thanks a lot for your help and best regards.
Adele JIA
