First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Why is this Canon BJNP protocol in the Protocol Hierarchy Statistics?

  • retag add tags

Here are 2 screenshots https://imgur.com/a/8gua4uu

I don't have any Canon devices. Does Wireshark misidentify things to this extent? I'm using Brave browser, and occasionally playing a few games from legal sources.

0internetuser1's avatar
1
0internetuser1
asked 2023-05-08 02:02:41 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

When looking at the dissector, any UDP packet on port 8611-8614 which has a printable character at the start is considered a Canon BJNP packet. Also the services file identifies these ports as used for Canon BJNP. However, these are not reserved ports, so it's not inconceivable that another use is made of these ports, with another protocol. That is what seems to be the case here.

Jaap's avatar
13.7k
Jaap
answered 2023-05-08 05:35:18 +0000
edit flag offensive 0 remove flag delete link
more

Comments

And, other than the port range check, that's a fairly weak heuristic, so, yes, Wireshark does misidentify things to this extent. If more tests could be added to the Canon BJNP dissector so that it misidentifies fewer packets, that should be done.

Guy Harris's avatar Guy Harris (2023-05-08 20:00:29 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer