tcpdump mailing list archives
Re: Request for new DLT value for Wireshark Dissector
From: Guy Harris <guy () alum mit edu>
Date: Tue, 1 Feb 2011 01:00:47 -0800
On Jan 26, 2011, at 2:30 AM, Schemmel, Hans-Christoph wrote:
The size of the header depends on the number of PPP packets in the payload of the MUX frame. The Header_Size indicates whether Msg_ID, Freq_ID, Start_Pos, End_Pos, and Flag are present. For example: The header of a frame without PPP packet is | Header_Size (=0) | Direction | MUX_Frame The header of a frame with one PPP packet is | Header_Size | Msg_ID | Freq_ID | Start_Pos | End_Pos | Flag | Direction | MUX_Frame The header of a frame with two PPP packet is | Header_Size | Msg_ID | Freq_ID | Start_Pos | End_Pos | Flag | Msg_ID | Freq_ID | Start_Pos | End_Pos | Flag | Direction | MUX_Frame
OK, so the Direction field and Header_Size fields are always present, and the Header_size field gives the size of the *optional* fields; if a frame contains N PPP packets, the Header_Size field has the value 5N. (If Header_Size isn't a multiple of 5, the frame is presumably invalid.) Is that correct? Presumably, if the Start_Pos and End_Pos of one packet overlap the Start_Pos and End_Pos of another packet, the frame is invalid. If there are parts of the MUX_Frame that don't correspond to any packet, is the frame invalid? (If so, Start_Pos and End_Pos could presumably be replaced by a length field, and the only "frame is invalid" case there would be if a frame ran past the end of the MUX_Frame, or the packet were too short to be a PPP packet.)- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Request for new DLT value for Wireshark Dissector Schemmel, Hans-Christoph (Jan 10)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Jan 10)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Jan 12)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Jan 12)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Jan 17)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Jan 17)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Jan 19)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Jan 20)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Jan 25)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Jan 26)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Feb 01)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Feb 03)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Feb 03)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Feb 04)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Feb 06)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Feb 07)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Feb 10)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Feb 14)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Feb 14)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Feb 15)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Mar 02)
- Re: Request for new DLT value for Wireshark Dissector Schemmel , Hans-Christoph (Jan 12)
- Re: Request for new DLT value for Wireshark Dissector Guy Harris (Jan 10)