Re: [libpcap] New DLT value Request - Wattstopper DLM (#401)

[Guy Harris <guy () alum mit edu>]

On Jan 8, 2015, at 3:35 PM, Steve Karg <skarg () users sourceforge net> wrote:

> The Packet Delay field contains an integer value that is the
> number of milliseconds since the previous packet.

Presumably, in pcap or pcap-ng files with valid packet time stamps, this is redundant.

> The Preamble 1 and Preamble 2 fields should each contain 0xAA.
>
> The Family/Address/IR field contains 3-bits of family code, 2-bits of
> address mode, 2-bits of IR (infrared) routing, and 1-bit unused.
> The 8 Legrand NITOO families are 000=CAD Filaire, 001=TopDog, 010=CAD RF,
> 011=CAD PLC, 100=CAD IR, 101=DLM, 111=escape, and 111=DLM Bootloader).
> This document only describes the DLM family.

Are the fields following the Family/Address/IR field dependent on the family code?  Or can the rest of the packet, with 
the possible exception of the opcode and payload, be parsed the same way regardless of the family code?

Are the family codes dependent on the hardware being used?

> The Address mode bits are defined as:
> (00=Broadcast, 01=multicast, 10=unicast, 11=anonymous unicast).
>
> The Sequence ID field contains an incrementing sequence number.
>
> The Source MAC is the 32-bit serial number of the originating device.
>
> The Destination MAC is the 32-bit serial number of the any unicast receiver,
> or various values for broadcast or multicast.
>
> The Opcode field contains the message command, which determines the Payload
> and Payload Length fields.

Presumably the Payload Length field is the number of octets in the Payload field.

Is there some other specification to which we can point for the values of the Opcode field, and the corresponding 
payload, or can this be used for several different families of opcodes (with the dissector presumably having to be told 
which one to use)?  (The spec doesn't have to itself describe the opcode or payload values, although, if there's a spec 
or specs for them, references to them might be useful.)

> The LRC Checksum excludes the Preamble octets.

Does it cover the Dongle Code or Packet Delay field?
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers