Guy Harris writes in message <[EMAIL PROTECTED]>
(Thursday 2001-April-5 15:34:31):
> > Is there anything in the works for selecting or pretty-printing
> > information on the DIX, SNAP, and 802.2 Ethernet encapsulations? I
> > think that doing things like 'ether[14:2] == 0xaaaa' works,
> Try the current CVS version; the filter for selecting IPX frames is,
> well, "ipx", which checks for all four count 'em four flavors of IPX
> frames on Ethernet. (It only checks for 802.2 IPX frames on other
> networks; should it check for SNAP IPX frames as well?)
>
> As for pretty-printing, I'm not sure what you mean; if "It's helpful for
> IPX" means the frames you care about are IPX frames, and by
> "pretty-printing" you mean "correctly recognizing and handing to the IPX
> dissector", try the CVS version - it recognizes as IPX frames 802.2
> frames, with an LLC header and the IPX SSAP and DSAP of 0xe0 (3.6.2
> already recognizes:
>
> "802.3" IPX frames, with a length field and no LLC header;
>
> Ethernet II IPX frames, with an Ethertype of 0x8137
>
> SNAP IPX frames, with an LLC header, SSAP and DSAP of 0xAA, OUI
> of 0x000000, and protocol ID of 0x8137).
I haven't tried the CVS version yet, but e.g. can you select all 802.2
non-SNAP IPX frames, discarding the other 3 IPX possibilities. That
would be really nice. The current capability to simply select all IPX
frames as you mention is helpful too, I'll probably try it.
Raj
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
