Re: ISDN Layer 3 decode

[Guy Harris <guy () alum mit edu>]

On Oct 21, 2011, at 2:27 PM, Keith French wrote:

> It does have an Export option to Ethereal, but all packets show up as malformed.

"Ethereal"?  If it really says "Ethereal", it probably dates back before the introduction of the pcap link-layer types 
LINKTYPE_LAPD etc.; the only pcap encapsulation that a release called "Ethereal" supported (the last release called 
"Ethereal" was 0.99.0) was LINKTYPE_LINUX_LAPD.

What does capinfos say about the exported-to-Ethereal files?

> It can be saved in its own format (which I would think is highly protected) being a commercial product,

Well, some vendors of commercial network analyzers publish their capture file format, and others don't, but it might be 
possible to reverse-analyze the format.  Who are the two vendors in question?

> or in CSV or Text. The other analyser I mentioned that uses Wireshark saves its D channel decodes in TRC format.

What's "TRC format"?
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe