Re: Request for new DLT value for Wireshark Dissector

[Schemmel, Hans-Christoph <hans-christoph.schemmel () cinterion com>]

Guy Harris <guy <at> alum.mit.edu> writes:

> OK, so the Direction field and Header_Size fields are always present, and the
Header_size field gives the
> size of the *optional* fields; if a frame contains N PPP packets, the
Header_Size field has the value 5N. 
> (If Header_Size isn't a multiple of 5, the frame is presumably invalid.)

I´ve mixed up some field sizes in my previous mail. Msg_ID and Freq_ID have a
size of 2 octects, not 1 octect like the other fields, sorry. So the optional
part has a size of 7 octects. But your conclusion is correct: The Header_Size is
multiple of *7*, if there is a frame with N PPP packets, Header_Size is multiple
of 7. If it is not multiple of 7, the frame is not valid. Direction field and
Header_Size fields are always present.

> Presumably, if the Start_Pos and End_Pos of one packet overlap the Start_Pos
and End_Pos of another
> packet, the frame is invalid.  

Yes, that´s correct.

> If there are parts of the MUX_Frame that don't correspond to any packet, is
> the frame invalid?  
> (If so, Start_Pos and End_Pos could presumably be replaced
by a length field, and the
> only "frame is invalid" case there would be if a frame ran past the end of the
MUX_Frame, or the packet were
> too short to be a PPP packet.)-

It is possible that a valid Mux_frame (with PPP_frames as payload) has parts
that don´t correspond to a PPP packet. Two examples: (1) At the beginning of a
PPP connection, a Mux_frame with "CONNECT" (AT mode) and the first PPP packet.
(2) A Mux_frame with a LCP Terminate packet (PPP) and a "NO CARRIER" packet (AT
mode).

Kind regards,
Christoph Schemmel



-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.