Wireshark mailing list archives
Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets?
From: Jeff Morriss <jeff.morriss.ws () gmail com>
Date: Mon, 04 Jun 2012 17:02:13 -0400
Andreas Sikkema wrote:
On 6/1/12 22:42 , Gerald Combs wrote:On 6/1/12 1:15 PM, Jeff Morriss wrote:Though I am nervous about this whole packet-dependency thing causing users to say "I filtered on RTP and you saved my SIP too!"A few months ago I talked to someone who complained that Wireshark *didn't* do that. In his case it would've been useful to see related ARPs when filtering down to a TCP stream.Yes, but where does one stop going down that route? For RTP initiated by SIP one might want to be able to save the related SIP messages. For RTP initiated by H.323 it already needs H.225 and H.245, for some of the UMTS/3G protocols there's probably loads more involved. If you want context for a call IMHO it is up to the user to provide the context using capture/display filters. Not all context can be provided by conversations.
Yeah, this example had me thinking the same thing. Certainly I would never have considered TCP bringing in ARP, but I can see how a user might expect/want it. Maybe it's better to leave them with the current "be careful what you filter out!" behavior.
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Jeff Morriss (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Richard Sharpe (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Jeff Morriss (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Anders Broman (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Richard Sharpe (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Gerald Combs (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Andreas Sikkema (Jun 02)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Jeff Morriss (Jun 04)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Jeff Morriss (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Richard Sharpe (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Kukosa, Tomas (Jun 05)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Richard Sharpe (Jun 05)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Jeff Morriss (Jun 01)
- Re: Should payload dissectors' (RTP) packets depend on call-setup dissectors' (SIP) packets? Anders Broman (Jun 01)