> Is there anything in the works for selecting or pretty-printing
> information on the DIX, SNAP, and 802.2 Ethernet encapsulations? I
> think that doing things like 'ether[14:2] == 0xaaaa' works,
For selecting, not for pretty-printing.
For selecting, what it does is matches *all* SNAP-encapsulated packets.
The way to match all DIX-encapsulated packets is to check the
type/length field.
However, I'm not sure how useful it is to match *all* DIX, 802.2, and
802.2-SNAP packets.
> but was wondering about something nicer. It's helpful for IPX.
>
> I have tried 3.4 and 3.6.2.
Try the current CVS version; the filter for selecting IPX frames is,
well, "ipx", which checks for all four count 'em four flavors of IPX
frames on Ethernet. (It only checks for 802.2 IPX frames on other
networks; should it check for SNAP IPX frames as well?)
As for pretty-printing, I'm not sure what you mean; if "It's helpful for
IPX" means the frames you care about are IPX frames, and by
"pretty-printing" you mean "correctly recognizing and handing to the IPX
dissector", try the CVS version - it recognizes as IPX frames 802.2
frames, with an LLC header and the IPX SSAP and DSAP of 0xe0 (3.6.2
already recognizes:
"802.3" IPX frames, with a length field and no LLC header;
Ethernet II IPX frames, with an Ethertype of 0x8137
SNAP IPX frames, with an LLC header, SSAP and DSAP of 0xAA, OUI
of 0x000000, and protocol ID of 0x8137).
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
