Re: New DLT_ value request

["Will Barker" <w.barker () zen co uk>]

> What is the format of the extra information you'll be putting at the 
> beginning of the {PPP, Cisco HDLC, Frame Relay, LAPB} packets to hold 
> the packet direction?  (Number of bytes, values to be put there, etc.)

It should just be akin to the pseudo header used for generic p2p links e.g.

/* Packet "pseudo-header" for point-to-point links with direction flags. */
struct p2p_phdr {
        gboolean        sent; /* TRUE=sent, FALSE=received */
};

> > In addition is it acceptable to have one further value defined for our 
> > own proprietary encapsulation type?

> By "proprietary" do you mean you'll be using this only internally within 
> your company, with special internal versions of tcpdump/Wireshark/etc. 
> or special internal-only Wireshark plugins, or do you mean you'll be, 
> for example, submitting a dissector for that encapsulation for inclusion 
> in Wireshark?

The latter (submitting a dissector for that encapsulation for inclusion in
Wireshark)

Thanks

Will

-----Original Message-----
From: tcpdump-workers-owner () lists tcpdump org
[mailto:tcpdump-workers-owner () lists tcpdump org] On Behalf Of Guy Harris
Sent: 28 November 2007 18:39
To: tcpdump-workers () lists tcpdump org
Subject: Re: [tcpdump-workers] New DLT_ value request

Will Barker wrote:
> Please may I request some additional libpcap DLT_ values? I need these to
> map onto the following wiretap values:
>
> 1.    WTAP_ENCAP_PPP_WITH_PHDR
> 2.    WTAP_ENCAP_CHDLC_WITH_PHDR
> 3.    WTAP_ENCAP_FRELAY_WITH_PHDR
> 4.    WTAP_ENCAP_LAPB

What is the format of the extra information you'll be putting at the 
beginning of the {PPP, Cisco HDLC, Frame Relay, LAPB} packets to hold 
the packet direction?  (Number of bytes, values to be put there, etc.)

> In addition is it acceptable to have one further value defined for our own
> proprietary encapsulation type?

By "proprietary" do you mean you'll be using this only internally within 
your company, with special internal versions of tcpdump/Wireshark/etc. 
or special internal-only Wireshark plugins, or do you mean you'll be, 
for example, submitting a dissector for that encapsulation for inclusion 
in Wireshark?

If the former, you could just use one of the DLT_USERn DLT_ values, and 
use one of the WTAP_ENCAP_USERn WTAP_ENCAP values, and not need an 
official DLT_ value.

If the latter, yes, you'd need to have a DLT_ value for that 
encapsulation type, and we'd provide one.

> Is there some formal request process for this?

The official process for asking for a DLT_ value is to, err, umm, send 
mail to tcpdump-workers () tcpdump org asking for the value. :-)

(I.e., this *is* the request process.)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.