On 7/17/07, Guy Harris <[EMAIL PROTECTED]> wrote:
Fulko Hew wrote:> So in the end... I think I'd rather continue persuing this single DLT > approach > where I can embed status/signalling stuff into a single dissector > > IE. Have a pcap with DLT_ACN_WAN and dissectors for: > ACN_WAN (that handles signal/status info and then dispatches to:) > Frame Relay (the existing one) > LAPB/X.25 (the existing one) > IPARS (one of my new ones) > UTS (one of my new ones) It might be possible to use DLT_PPI for this: http://www.cacetech.com/documents/PPI_Header_format_1.0.1.pdf although PPI was originally introduced for 802.11 and might not be ideal for your purposes. If it's not, we'll just go with DLT_ACN_WAN.
Well, I looked at it, and it sounds like a good idea, but it is relatively heavy weight (I only need to transport 4 bytes, and PPI has 8 bytes of overhead (200% in my case) So I'm going to graciously decline and still ask for my own DLT called 'DLT_SITA'. (This also leave my options open for the future in monitoring other things like STREAMs, named pipes, shared memory communications devices, etc.) - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
