Re: request for a DLT value for wireshark DVB-CI dissector

[Guy Harris <guy () alum mit edu>]

On Feb 13, 2011, at 3:14 PM, Martin Kaiser wrote:

> I'm working on a wireshark dissector for DVB-CI (Common Interface). The
> dissector analyzes the communication between a PC-Card module and a DVB
> receiver. It's not based on any other data link layer protocol.
>
> I defined the pcap packet data for the new DLT on
> http://www.kaiser.cx/pcap-dvbci.html

The "Packet Header" section is pcap-specific; the link-layer type values can also be used in pcap-ng captures.  In 
addition, note that tools that read pcap files - including Wireshark! - will not guarantee that they will interpret the 
time stamp in pcap records as anything other than UN*X time values, i.e. they won't be interpreted as "from the 
beginning of the capture", and values of 0 will be interpreted as January 1, 1970, 00:00:00 UTC.

If you want to say "no time stamp", use pcap-ng Simple Packet Blocks:

        http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionpbs

I think the right way to handle "from the beginning of the capture" time stamps, from my reading of the pcap-ng spec, 
is to put the capture start time into the Interface Description Block in a pcap-ng file as an if_tsoffset option.

> Basically, there'll be a pseudo-header around the bytes that are
> actually transfered, hardware events can also be logged.

What follows the pseudo-header?  The DVB spec you refer to says

        6.2     TSI - transport layer

        The transport layer used is the same as the MPEG-2 System transport layer. Data travelling over the transport 
stream interface is organised in MPEG-2 Transport Packets. The whole MPEG-2 multiplex is sent over this transport 
stream interface and is received back fully or partly descrambled. If the packet is not scrambled, the module returns 
it as is. If it is scrambled and the packet belongs to the selected service and the module can give access to that 
service, then the module returns the corresponding descrambled packet with the trans- port_scrambling_control flag set 
to '00'.

        If scrambling is performed at Packetised Elementary Stream (PES) level, then the module reacts in the same way 
and under the same conditions as above, and returns the corresponding descrambled PES with the PES_scrambling_control 
flag set to '00'.

        The transport packet and the PES packet are completely defined in the MPEG-2 System specification [1].

So does each packet correspond to an MPEG-2 Transport Packet, or something else?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.