Re: Request for a new DLT

["Fulko Hew" <fulko.hew () gmail com>]

On 7/17/07, Guy Harris <guy () alum mit edu> wrote:
> Fulko Hew wrote:
>
> > So in the end... I think I'd rather continue persuing this single DLT
> > approach
> > where I can embed status/signalling stuff into a single dissector
> >
> > IE.  Have a pcap with DLT_ACN_WAN and dissectors for:
> >   ACN_WAN (that handles signal/status info and then dispatches to:)
> >     Frame Relay (the existing one)
> >     LAPB/X.25  (the existing one)
> >     IPARS (one of my new ones)
> >     UTS (one of my new ones)
>
> It might be possible to use DLT_PPI for this:
>
>         http://www.cacetech.com/documents/PPI_Header_format_1.0.1.pdf
>
> although PPI was originally introduced for 802.11 and might not be ideal
> for your purposes.  If it's not, we'll just go with DLT_ACN_WAN.

Well, I looked at it, and it sounds like a good idea, but it is relatively heavy
weight (I only need to transport 4 bytes, and PPI has 8 bytes of overhead
(200% in my case)  So I'm going to graciously decline and still ask for
my own DLT called 'DLT_SITA'.

(This also leave my options open for the future in monitoring other things
like STREAMs, named pipes, shared memory communications devices, etc.)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.