Hi I'd like to be able to capture packets from a non-supported transport and transfer them to Ethereal for decoding.
Specifically I would like to be able to display packet transfers across a RapidIO link. I have written a utility to generate trace files in libpcap format and a dissector to the RapidIO transport layer.
The problem that I am running into is how to communicate the transport type to Ethereal. There is no "DLT_" value for this transport, and therefore Ethereal has no knowledge of where to start when decoding the file.
One approach to this problem would be to create a new Data Link Type called "DLT_NAMED" and add an additional parameter to the libpcap file header, as follows:
// "libpcap" file header
struct pcap_hdr {
uint32 magic; // magic number
uint16 version_major; // major version number
uint16 version_minor; // minor version number
int32 thiszone; // GMT to local correction
uint32 sigfigs; // accuracy of timestamps
uint32 snaplen; // max length of captured packets
uint32 network; // data link type = DLT_NAMED
char dlt_name[]; // data link protocol name
};The dlt_name parameter would be the PROTOABBREV name used by the protocol dissector. Using this mechanism users could easily add support for new data links for Ethereal such as RapidIO, PCI Express etc.
Am I missing something? Is there an easier way to do this? Any feedback would be appreciated.
Kent Dahlgren
