Re: Linux Frame-Relay and misc

[Krzysztof Halasa <khc () pm waw pl>]

Guy Harris <guy () alum mit edu> writes:

> I guess the question I really meant to ask was "are Q.933 and LMI the
> same thing?"

Well. No: LMI can mean two things:
1. the original LMI, aka Cisco LMI, aka Gang of Four LMI. Using 0x09 and
   DLCI 1023 (with 10-bit DLCI, and IIRC 2^N-1 for N > 10)

2. (the usual meaning) there is Cisco LMI (1), ANSI LMI and CCITT LMI.
ANSI and CCITT LMIs use 0x08 and DLCI 0, and they are very similar (unlike
Cisco LMI) - the difference is ANSI locking shift (0x95) in 3rd byte of LMI
message and different message type numbers (see the code).

> I.e., should 0x08 be NLPID_LMI,

I thinks so, as it describes both ANSI and CCITT (Q.933 annex A) LMI,
while 0x09 is Cisco-only.

> or NLPID_Q933, or NLPID_Q933_LMI, as,
> presumably, a packet beginning with 0x08 could be a Q.933 packet?

Yes. Or ANSI T1.617 annex D one.
So I think it's best called NLPID_LMI, with Cisco LMI called
NLPID_CISCO_LMI.

OTOH 0x08 can also be, at least in theory, some other thing, something
different than LMI - according to std55/rfc2427:
   For those protocols which do not have a NLPID assigned or do not have
   a SNAP encapsulation, the NLPID value of 0x08, indicating ITU
   Recommendation Q.933 should be used.

I've never seen it in practice, and it is not supported by print-fr
(neither previous one or my patch). 

So, currently, 0x08 = (CCITT or ANSI) LMI.

I will look deeper at it.

> #include "addrtoname.h" *not* removed, as it declares
> "etherproto_string()", which is called in "fr_if_print()".

Ok. It seems I just trusted gcc or something else too much - it didn't
scream about missing prototype.

> > With CCITT LMI tcpdump now produces something like:
> > 00:31:01.165621 DLCI 0, LMI, length 9: CCITT STATUS ENQUIRY
> >                 IE: 51 Len: 1, LINK VERIFY
> >                 IE: 53 Len: 2, TX Seq:   9, RX Seq:   8
>
> I think the general convention is not to print more than one line per
> packet unless "-vv" or more is given, i.e. don't print more than one
> line per packet unless vflag > 1.

I will correct that, then - multiple lines come from previous version.

Thanks.
-- 
Krzysztof Halasa, B*FH
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe