Guy Harris wrote: >On Tue, May 27, 2003 at 11:41:19AM +0100, CNS - Matthew Bradley wrote: >> I've spoken to one of our suppliers who lives and breathes OSLAN. >> >> He says that ICL were the only company in the world to choose LLC SAP 0x54 >> for their mainframes, and he suggested this was a unilateral decision. My >> contact's experience is that all OSLAN hosts other than ICL mainframes >> normally use a SAP 0x14. >> >> So I fear that it will not be possible to identify OSLAN based on LLC alone. > >Well, if neither a SAP value of 0x14 or of 0x54 is used for anything >*other* than OSLAN, then OSLAN traffic can be identified based on LLC >alone as traffic for SAP 0x54 *or* SAP 0x14. > >Is it the case that 14 and 54 are both used for OSLAN and nothing else?
I converted the capture to NAI Sniffer DOS format and loaded it into four other protocol analysers. I didn't have time to expirement more today, but can maybe later edit the capture a bit with text2pcap and see what results I get some different combinations of SAP values. NAI Sniffer: ---------------- The packets were decoded as ISO-TP (i.e. COTP) over CLNP (Null). There was no specific indication what SAP 0x14 or 0x54 meant. Wandel & Goltermann Examine: -------------------------------------------- The packets were decoded as ISO-TP (i.e. COTP) over CLNP (Null). SAP 0x14 was indicated as "0x14 (ISO)" SAP 0x54 was indicated as "0x54 (ISO)" Finisar Surveyor (demo version): --------------------------------------------- Only the Ethernet and LLC part decoded, the rest of the packet shown as "Data". Microsoft Network Monitor: ------------------------------------- Only the Ethernet and LLC part decoded.
