Guy Harris <[EMAIL PROTECTED]> writes: > I guess the question I really meant to ask was "are Q.933 and LMI the > same thing?"
Well. No: LMI can mean two things: 1. the original LMI, aka Cisco LMI, aka Gang of Four LMI. Using 0x09 and DLCI 1023 (with 10-bit DLCI, and IIRC 2^N-1 for N > 10) 2. (the usual meaning) there is Cisco LMI (1), ANSI LMI and CCITT LMI. ANSI and CCITT LMIs use 0x08 and DLCI 0, and they are very similar (unlike Cisco LMI) - the difference is ANSI locking shift (0x95) in 3rd byte of LMI message and different message type numbers (see the code). > I.e., should 0x08 be NLPID_LMI, I thinks so, as it describes both ANSI and CCITT (Q.933 annex A) LMI, while 0x09 is Cisco-only. > or NLPID_Q933, or NLPID_Q933_LMI, as, > presumably, a packet beginning with 0x08 could be a Q.933 packet? Yes. Or ANSI T1.617 annex D one. So I think it's best called NLPID_LMI, with Cisco LMI called NLPID_CISCO_LMI. OTOH 0x08 can also be, at least in theory, some other thing, something different than LMI - according to std55/rfc2427: For those protocols which do not have a NLPID assigned or do not have a SNAP encapsulation, the NLPID value of 0x08, indicating ITU Recommendation Q.933 should be used. I've never seen it in practice, and it is not supported by print-fr (neither previous one or my patch). So, currently, 0x08 = (CCITT or ANSI) LMI. I will look deeper at it. > #include "addrtoname.h" *not* removed, as it declares > "etherproto_string()", which is called in "fr_if_print()". Ok. It seems I just trusted gcc or something else too much - it didn't scream about missing prototype. > > With CCITT LMI tcpdump now produces something like: > > 00:31:01.165621 DLCI 0, LMI, length 9: CCITT STATUS ENQUIRY > > IE: 51 Len: 1, LINK VERIFY > > IE: 53 Len: 2, TX Seq: 9, RX Seq: 8 > > I think the general convention is not to print more than one line per > packet unless "-vv" or more is given, i.e. don't print more than one > line per packet unless vflag > 1. I will correct that, then - multiple lines come from previous version. Thanks. -- Krzysztof Halasa, B*FH - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
