Re: [tcpdump-workers] New LINKTYPE_ for EPON

2014-04-24 Thread Philip Rosenberg-Watt
>So is there any technical reason *not* to dissect the frame by: > > if that octet doesn't have the upper 6 bits as 010101, report it as an >error; > > if that octet is 0x55, show it as a preamble octet, and treat the frame >as not encrypted; > > if that octet is 0x54, report it

Re: [tcpdump-workers] Coverity Scan: the-tcpdump-group/libpcap success

2014-04-24 Thread Michael Richardson
Francois-Xavier Le Bail wrote: >> scan-ad...@coverity.com wrote: >>     > Your request for analysis of the-tcpdump-group/libpcap has been >>     > completed.  The results    > should be available now at >>     > http://scan.coverity.com/ >> >> wow, that's a stupidly useles

Re: [tcpdump-workers] New LINKTYPE_ for EPON

2014-04-24 Thread Guy Harris
On Apr 24, 2014, at 6:13 AM, Philip Rosenberg-Watt wrote: > I thought about that solution, and it's probably the best. The only thing > you lose is the positive confirmation that the information is *not* > encrypted, You could show that octet as a preamble octet *and* show the 0x02 bit, so it'

Re: [tcpdump-workers] New LINKTYPE_ for EPON

2014-04-24 Thread Guy Harris
On Apr 24, 2014, at 6:31 AM, Philip Rosenberg-Watt wrote: > Then how are we to determine if the capture is 1G or 10G mode? Do we > simply exclude the possibility of XX being 010101 for the MPCP LSB? Or > are we back to a preference, but to select 1G vs 10G mode? Or maybe a > LINKTYPE_EPON_1