Revision history  [back]

packet-ipp.c:

void proto_reg_handoff_ipp(void) {
    dissector_handle_t ipp_handle;

    /*
     * Register ourselves as running atop HTTP and using port 631.
     */
    ipp_handle = create_dissector_handle(dissect_ipp, proto_ipp);
    http_tcp_dissector_add(631, ipp_handle);
    dissector_add_string("media_type", "application/ipp", ipp_handle);
}

There is no preference to change the port. The dissector expects IPP to be on top of HTTP.
Have you tried Decode As... and setting the type to HTTP?

There is a sample capture (happens to be IPv6) attached to issue 12970 that is using ports other than 631.

Also a sample capture on the Wireshark wiki: ipp.pcap (libpcap) CUPS printing via IPP (test page)

Once the HTTP is available, the dissector then looks for Content-Type: application/ipp