On Wed, Apr 03, 2002 at 03:31:09PM +0200, Marcin Gryszkalis wrote: > tethereal 0.9.3, with GLib 1.2.10, with libpcap 0.7, with libz 1.1.3, > without UCD SNMP, FreeBSD 4.5 stable > > I think the packet is bad (I don't think I have anything on x.25 here.
No, the packet isn't bad - it just happens to have been sent to or from 1998, which is the port for RFC 1613 X.25-over-TCP. There is a bug, but it'll take a little work to fix (the problem is that the X.25 dissector assumes that the direction of the packet - DTE->DCE, or DCE->DCE - is available in a "pseudo-header" from the packet trace, but that's not the case for X.25-over-TCP on top of Boring Old Ethernet, so we need to have another mechanism for supplying the direction flag; the right way is probably to have all dissectors that call the X.25 dissector supply the flag as part of "private data" pointed to by "pinfo->private_data", with the LAPB dissector taking the flag from the pseudo-header and putting it in an X.25-specific structure, and the XOT dissector computing the flag based on whether the packet is going to or coming from the X.25-over-TCP port).
