I have a dissector which seems to work perfectly. If I register to the TCP ports specifically, it is clean, but if I instead use it as heuristic TCP, it will run, but then below the dissector's tree entry there is a "data" entry with the TCP payload, even though the dissector should have consumed the entire payload. Is there a way to block this behavior so that the dissector's tree data will not be followed by the extra entry? Thanks in advance! asked 22 Feb '12, 04:56 Clifford Haas closed 23 Feb '12, 07:28 multipleinte... |
What was wrong with the answer Jaap gave to your near identical question from yesterday?