On 7/17/07, Guy Harris <[EMAIL PROTECTED]> wrote:
Fulko Hew wrote:
> So in the end... I think I'd rather continue persuing this single DLT
> approach
> where I can embed status/signalling stuff into a single dissector
>
> IE. Have a pcap with DLT_ACN_WAN and dissectors for:
> ACN_WAN (that handles signal/status info and then dispatches to:)
> Frame Relay (the existing one)
> LAPB/X.25 (the existing one)
> IPARS (one of my new ones)
> UTS (one of my new ones)
It might be possible to use DLT_PPI for this:
http://www.cacetech.com/documents/PPI_Header_format_1.0.1.pdf
although PPI was originally introduced for 802.11 and might not be ideal
for your purposes. If it's not, we'll just go with DLT_ACN_WAN.
Well, I looked at it, and it sounds like a good idea, but it is relatively heavy
weight (I only need to transport 4 bytes, and PPI has 8 bytes of overhead
(200% in my case) So I'm going to graciously decline and still ask for
my own DLT called 'DLT_SITA'.
(This also leave my options open for the future in monitoring other things
like STREAMs, named pipes, shared memory communications devices, etc.)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.