Wireshark · Ethereal-dev: Re: [ethereal-dev] New Dissector for Sinec H1

[Laurent Deniel <deniel@xxxxxxxxxxx>]

Gerrit Gehnen wrote:
> 
> > This patch appears to treat all COTP packets as being H1 packets; is
> > there any way to determine, e.g. from the TSAP, whether the packet is an
> > H1 packet.
> 
> Possible approaches to determine the H1 protocol are
> - TSAP's are 8 characters for S5-PLC's, which are all printable
>   (for S7-PLC's they are 2 characters which are non printable....)
> - H1 uses the inactive subset of CLNP only (see my patch for
> packet-osi.c
>   last month). IMHO this is the most relevant point.
> - A further quick check is to look at the first two bytes of the higher
> level
>   which are ASCII 'S5'.
> 
> Are there any other protocols, which collide with the H1-Dissector?
> In packet-osi I found that all decoding is directed to the generic
> data dissector.
> 

It does not currently collide but this might happen in the future (and
that breaks some proprietary protocol dissectors build on top of COTP).
But in any cases, calling H1 dissecter for all DT TPDU is bad. Even if
the test of "S5" is already done in dissect_h1, a test of the inactive 
subset of CLNP should be added (at least).

Laurent.

--
Laurent DENIEL        | E-mail: deniel@xxxxxxxxxxx
Paris, FRANCE         |         laurent.deniel@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
                      | WWW   : http://www.worldnet.fr/~deniel
    All above opinions are personal, unless stated otherwise.