tcpdump mailing list archives

Re: Request for new DLT value for Wireshark Dissector


From: Schemmel, Hans-Christoph <hans-christoph.schemmel () cinterion com>
Date: Mon, 17 Jan 2011 13:52:05 +0000 (UTC)

Is this DLT value only for the Basic Option, or is it also used for the
Advanced Option?  If it's also for the
Advanced Option:

      1) Is the flag octet 0x7E if the Advanced Option is being used?

      2) If the Advanced Option is being used, do the packet contents include
escape octets, or has de-escaping
already been done?

The DLT will be used for Basic and Advanced Option, but the multiplexer protocol
doesn´t distinguish between Basic and Advanced Option and every packet begins
with the 0xF9 flag. The protocol implements the Basic Option with the additional
feature of the Error Recovery Mode, which is a subset of the GSM 07.10 Advanced
Option.



Do frames include the FCS?

Yes, the checksum is included in the frame.



Presumably I-frame support could be added without breaking dissection of other
captures?


Does the control field for those frames have a value that doesn't collide with
any values specified in TS
27.010, so that dissecting UIH_E frames won't break dissection of any frames
that conform to TS 27.010?-

The control type of the UIH_E frame is coded as I frame, so they could be a
collision with TS 27.010.

Concerning dissecting: The communication between GSM modem and the host is
captured with an USB Tracer. The tracer uses a proprietary format for the trace
files, but the data of these files can be exported, e.g. as csv file. I´ve
written a parser to process the files and to write the data in a pcap file. In
front of a captured multiplexer packet the parser writes an additional header of
variable size. This header contains information about the frame direction and
(optional) splitted packets inside of the multiplexer frames, e.g. splitted PPP
packets in the payload. This information is needed to reassemble splitted
packets in the dissector.


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: