Re: Request for new DLT value for Wireshark Dissector

[Guy Harris <guy () alum mit edu>]

On Feb 14, 2011, at 6:26 AM, Schemmel, Hans-Christoph wrote:

> Yes, Start_Pos and End_Pos are relative to the beginning of the MUX_Frame, but a
> PPP chunk does not start directly at the beginning of a MUX_Frame (Start_Pos=0).
> The PPP frame starts after the header fields of the MUX_Frame. 
> I.e. if we have 4 octets for the MUX_Frame header (flag, address, contol &
> length) and a 4-byte PPP chunk, Start_Pos would be *5* (the 5th byte in the
> MUX_Frame is the first byte of the PPP frame) and End_Pos would be *8* (the 8th
> byte in the MUX_Frame is the last byte of the PPP frame).

OK, so:

A MUX27010 MUX_Frame starts with a MUX_Frame header (which is a TS 27.010-like header), followed by zero or more bytes 
of data.

That data is a mixture of chunks of uninterpreted data and PPP chunks.

The PPP chunks are indicated by the {Msg_ID, Freq_ID, Start_Pos, End_Pos, Flag} quintuplets, where Start_Pos is the 
1-origin index (i.e., the first byte of the MUX_Frame has an index of 1, not 0), from the beginning of MUX_Frame, of 
the first byte of the chunk, and End_Pos is the 1-origin index, from the beginning of MUX_Frame, of the last byte of 
the chunk.

All the chunks of a given PPP packet have the same Msg_ID value.

Is Freq_ID a sequence number for the chunks in a PPP packet?  I.e., is the Freq_ID for the N+1st chunk equal to the 
Freq_ID for the Nth chunk plus 1?  If so, does the first chunk have a Freq_ID of 0, or 1, or some other value?

The last chunk of a given PPP packet has a Flag value of 1; the others have a Flag value of 0.

Is that correct?-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.