Re: Request for new DLT value for Wireshark Dissector

[Guy Harris <guy () alum mit edu>]

On Feb 4, 2011, at 1:59 AM, Schemmel, Hans-Christoph wrote:

> The parts that don´t correspond to a PPP packet are AT commands or responses
> (like "ATI", "AT+CSQ" or "+CSQ: 18,99"). This content is interpreted and
> displayed as raw text in the Wireshark subtree for the payload/information of a
> packet. These commands and responses don´t need to be dissected.

...lthough it might be interesting information, so it might be worth showing it as text.

For link-layer types that don't correspond to published standards, I like to have a description in bpf.h, so that 
people know how to dissect the link-layer header (and know not to use the link-layer type if the header isn't exactly 
the same); should I just describe the holes as "other data", so you're not constrained to forever make them all be AT 
command/response text, or is it guaranteed (now and forever) to be AT-command-or-response text?-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.