Added by Philippe Antoine over 1 year ago. Updated 5 months ago.
Description
Like DCERPC can be directly over UDP, or over SMB
Related issues 2 (2 open — 0 closed)
Related to Is duplicate of Has duplicate Blocks Blocked by Precedes Follows Copied to Copied from Issue # Delay: days Cancel
Like web socket, COTP...
Idea to do this : create a synthetic sub flow, so that each flow has its own app-layer
Philippe Antoine wrote in #note-4:
People may get confused if two flows get logged (one synthetic and a real one) with different app-layers
Also available in: Atom PDF