At 05:16 AM 1/7/2005, you wrote:
Gcom, Inc. wrote:
I'm the lead for a project involving line monitoring of T1/E1 lines. We are planning on exporting captured frames to Ethereal in tcpdump/libpcap format, so we'd like a DLT. Who do I contact about this?
[EMAIL PROTECTED] :-)
Hey, for all I knew, there was a Grand Poobah of DLT's who of course never deigned to read the workers list. :-)
What're the contents of those frames? If they contain IP or IPX or... traffic, they should be exported to applications using libpcap as well, by adding support for the DLT value in libpcap (for filtering) and tcpdump (for printing).
We expect the majority of the carried traffic to be LAPD or LAPB/X.25, with some Frame Relay and SS7 thrown in for good measure. We've defined a per-frame header that includes the next protocol above it, so either the end-user can configure it explicitly or possibly an expert system can fill it in.
The files (or datastreams in libpcap format) will actually be merged data from possibly hundreds of remote devices, so the header includes identifying information about what line it came from.
Speaking of headers, here's the header we settled on:
host ID -- IPv4 address (32-bit) +0
physical port (32-bit) +4
timeslot mask (32-bit) +8
sequence number (32-bit) +12
encapsulated protocol (16-bit) +16
transaction (8-bit) +18
reserved (8-bit) +19All fields are in network order.
We already have a dissector written to make Ethereal understand our header and pass it to the right next-level dissector. Until we get a DLT, we're using DLT_USER1 for our internal development. Once we have a DLT, we can release the dissector and move on to more interesting parts of the problem.
Regards,
Oolan Zimmer
Gcom, Inc.
[EMAIL PROTECTED]
[EMAIL PROTECTED]
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
