tcpdump mailing list archives

Re: Request for new DLT and LINKTYPE value


From: Michael Richardson <mcr () sandelman ca>
Date: Thu, 15 Apr 2010 21:04:30 -0400

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


"Thomas" == Thomas Edgar <Edgar> writes:
    Thomas> With the timing method I am using I was going for a method
    Thomas> to capture anything from a COM port and then allow the
    Thomas> parsing mechanism (like the heuristic dissectors in
    Thomas> Wireshark) to determine what protocol is actually present.
    Thomas> I am going for a more hands off user experience than
    Thomas> requiring them to decide beforehand which protocol to
    Thomas> capture.  What do you think?

I suggest you have a DLT_ASYNC_RAW type, and just define that each frame
contains 1024 bytes, or 100ms or something of data.

If you have a heuristic guesser, and you can, output, PPP or SLIP or
Modbus, or .... then you resave it in appropriate DLT_*...

- -- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr () sandelman ottawa on ca http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
                       then sign the petition. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Finger me for keys

iQEVAwUBS8e3nYCLcPvd0N1lAQItvgf+MS+NEn2ADikF0fQPoZBdPZ9/ISrbxkYG
AEeWQ6q7KQzjqOKZMN8GPzt/zXUsojUjKKF+focNmHEcZfVNoQeV8KYJA+PlMZH9
Z9dvMdZ9WY8ZCQYv3DdNygO58i7u0acAHVZsXRHYq62+MOOciThNMSz4yg49hGLY
+e6blIj/xQvj6n4dkYyQHT9omcNyMntnqXVvViP00to0BY1VeNUV8JI3Pnpcyvi4
gWKAV57cBAXF1k4AvwYrSVoJVgk19eySapp/DE6CBqS+w+Bg1dqkk9LAw5jbSZ8y
I2auj93MHVXCacXXH6X0MDe5ka4QTOjUvfxU7UKqIkVPjicCQbtz3A==
=ihEQ
-----END PGP SIGNATURE-----
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: