1 | initial version |
It's most likely not DRDA
which is a heuristic decoder.
epan/dissectors/packet-drda.c:
heur_dissector_add("tcp", dissect_drda_heur, "DRDA over TCP", "drda_tcp", proto_drda, HEURISTIC_ENABLE);
It's tough to confirm without a capture file. You can work through the code to see why your packets are a match.
epan/dissectors/packet-drda.c:
dissect_drda_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) { conversation_t * conversation; if (tvb_captured_length(tvb) >= 10) { /* The first header is 6 bytes long, so the length in the second header should 6 bytes less */ guint16 cOuterLength, cInnerLength; cOuterLength = tvb_get_ntohs(tvb, 0); cInnerLength = tvb_get_ntohs(tvb, 6); if ((tvb_get_guint8(tvb, 2) == DRDA_MAGIC) && ((cOuterLength - cInnerLength) == 6)) { /* Register this dissector for this conversation */ conversation = find_or_create_conversation(pinfo); conversation_set_dissector(conversation, drda_tcp_handle); /* Dissect the packet */ dissect_drda_tcp(tvb, pinfo, tree, data); return TRUE; } } return FALSE; }
Disable DRDA
(Analyze -> Enabled Protocols...
) to see which dissector grabs it next.