I have instances of VoIP traffic to sites where Wireshark says some of the flows are using UDP and some are marked as GVSP. I know that GVSP is UDP too, I was just wondering why Wireshark displays them differently? asked 23 Mar '16, 07:47  Aztecdoug |
One Answer:
Because Wireshark tries to give an as detailed as possible dissection of the network data. If it thinks there's GVSP payloads in there and the relevant dissector is enabled, it will try to dissect that payload. Why does it think it's there in the first place? That may depend on external signaling, heuristics, or manual configuration of the dissector. answered 23 Mar '16, 08:03  Jaap ♦ |
