I am having problems with viewing CQL. I am using WS 2.2.0rc2 (just released yesterday). I load the pcap and it comes up as TCP frames. I try to do "Analyze->Decode As..." using CQL, it rescans the file and, again, displays as TCP frames. In the early frames from my Cassandra box I can see "CQL_VERSION....3.4.2". In the release notes it says "New Protocol Support" "Apache Cassandra - CQL version 3.0". Is this an issue with a minor release of CQL? asked 01 Sep '16, 07:58  ekleinpaste |
One Answer:
It could very well be. The dissector checks the very first byte of every packet and if it's not 0x03 or 0x83 then it will spit it out. If you can share the capture file this could be confirmed. answered 01 Sep '16, 09:59  Jaap ♦ |
That is it. They start with 0x04 and 0x84. Where would you like the capture file to go?
Either attached to a bug report, on cloudshark.org, or any other publicly accessible place.
I created a trial account on cloudshark.org and uploaded CQL-3-4-2.cap.gz. I did not see a choice for doing a bug report.
Wireshark bug report should be submitted at bugs.wireshark.org
Bug submitted on bugs.wireshark.org. Bug 12818.