Re: Request for new DLT value for Wireshark Dissector

[Guy Harris <guy () alum mit edu>]

On Jan 26, 2011, at 2:30 AM, Schemmel, Hans-Christoph wrote:

> The size of the header depends on the number of PPP packets in the payload of
> the MUX frame. The Header_Size indicates whether Msg_ID, Freq_ID, Start_Pos,
> End_Pos, and Flag are present.
> For example:
> The header of a frame without PPP packet is
> | Header_Size (=0) | Direction | MUX_Frame
>
> The header of a frame with one PPP packet is
> | Header_Size | Msg_ID | Freq_ID | Start_Pos | End_Pos |  Flag  | Direction |
> MUX_Frame
>
> The header of a frame with two PPP packet is
> | Header_Size | Msg_ID | Freq_ID | Start_Pos | End_Pos |  Flag  | Msg_ID |
> Freq_ID | Start_Pos | End_Pos |  Flag  | Direction | MUX_Frame

OK, so the Direction field and Header_Size fields are always present, and the Header_size field gives the size of the 
*optional* fields; if a frame contains N PPP packets, the Header_Size field has the value 5N.  (If Header_Size isn't a 
multiple of 5, the frame is presumably invalid.)

Is that correct?

Presumably, if the Start_Pos and End_Pos of one packet overlap the Start_Pos and End_Pos of another packet, the frame 
is invalid.  If there are parts of the MUX_Frame that don't correspond to any packet, is the frame invalid?  (If so, 
Start_Pos and End_Pos could presumably be replaced by a length field, and the only "frame is invalid" case there would 
be if a frame ran past the end of the MUX_Frame, or the packet were too short to be a PPP packet.)-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.