Re: [tcpdump-workers] Request for new DLT value for Wireshark

2011-03-09 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > OK, I've assigned 236 as LINKTYPE_MUX27010 and DLT_MUX27010. > Thank you very much! Kind regards, Christoph Schemmel - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] Request for new DLT value for Wireshark

2011-03-03 Thread Schemmel, Hans-Christoph
Guy Harris alum.mit.edu> writes: > > Not yet - I've been somewhat busy the past week and a half, and I have to condense all the e-mail on this thread > into a complete and precise description of the data format, to put into the pcap/bpf.h and pcap-common.c > files. If somebody else were to do s

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-03-02 Thread Schemmel , Hans-Christoph
I just want to ask if you´ve already assigned a DLT value for the dissector? Kind regards, Christoph Schemmel - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-02-15 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > The PPP chunks are indicated by the {Msg_ID, Freq_ID, Start_Pos, End_Pos, Flag} quintuplets, where > Start_Pos is the 1-origin index (i.e., the first byte of the MUX_Frame has an index of 1, not 0), from the > beginning of MUX_Frame, of the first byte of the

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-02-14 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > Start_Pos and End_Pos are relative to the beginning of MUX_Frame, right? I.e., a 4-byte chunk starting at > the beginning of MUX_Frame would have a Start_POS of 0? Would End_POS be 3 (meaning that it's the offset of > the last byte of the chunk) or 4 (meani

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-02-07 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > should I just describe the holes as "other data", so you're not > constrained to forever make them all be AT command/response text, or is it guaranteed (now and forever) to > be AT-command-or-response text?- The description of the holes as "other data" sounds

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-02-04 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > OK, so it's: > > Header_Size: 1 octet > > A sequence of zero or more instances of: > > Msg_ID: 2 octets > > Freq_ID: 2 octets > > Start_Pos: 1 octet > > End_Pos: 1 octet > >

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-02-03 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > OK, so the Direction field and Header_Size fields are always present, and the Header_size field gives the > size of the *optional* fields; if a frame contains N PPP packets, the Header_Size field has the value 5N. > (If Header_Size isn't a multiple of 5, the fr

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-26 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > So are any of those fields optional? For example, is the fragment ID optional? If so, what indicates whether > it's present? If nothing is optional, why is the header size not always 7? > The size of the header depends on the number of PPP packets in th

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-20 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > What is the format of the additional header?- The format of the additional header is: | Header_Size | Msg_ID | Freq_ID | Start_Pos | End_Pos | Flag | ... | Msg_ID | Freq_ID | Start_Pos | End_Pos | Flag | Direction | MUX_Frame Header_Size (1 Octet): To

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-19 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > OK, so it sounds as if this isn't raw standard 27.010 traffic. Is MUX27010 likely to be used as a name for that > traffic? If not, we could call it DLT_MUX27010/LINKTYPE_MUX27010. > > What is the format of the additional header?- > This is the tcpdump-work

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-17 Thread Schemmel , Hans-Christoph
> Is this DLT value only for the Basic Option, or is it also used for the Advanced Option? If it's also for the > Advanced Option: > > 1) Is the flag octet 0x7E if the Advanced Option is being used? > > 2) If the Advanced Option is being used, do the packet contents include escape oc

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-12 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > > > On Jan 10, 2011, at 6:16 AM, Schemmel, Hans-Christoph wrote: > > > I´ve written a dissector (MUX27010) for wireshark and I want to commit it to the project. Therefore I need > a new DLT value for this dissector/protocol because t

[tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-01-10 Thread Schemmel, Hans-Christoph
Hi, I´ve written a dissector (MUX27010) for wireshark and I want to commit it to the project. Therefore I need a new DLT value for this dissector/protocol because the protocol doesn´t base upon another data link layer protocol. What the dissector does: It analyses a multiplexed communication bet