Wireshark mailing list archives

Identify mis-routed (port) protocol


From: matjesstreak <matjesstreak () gmail com>
Date: Thu, 16 Sep 2021 11:30:51 +0800

I am trying to identify what protocol a slew of (identical, short)
packets might be that were received on a highly likely wrong port

In WS I can use 'decode as' but that would require me to try each and
every one

Is there any tool that can do this automatically and offer me
likely candidates for closer inspection?
In particular. I can identify where in the packet there is
a string (readable in the hex-dump) which is misinterpreted
by the protocol dissector usually associated with that port
as integers. So anything that can tell me protocols that have
a length-prefixed string at position n (with y bytes of prefix)
and then spit those out for me to look at further would be useful

thx
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: