Wireshark · Ethereal-dev: [Ethereal-dev] Dissector for DOCSIS

["Anand V. Narwani" <anarwani@xxxxxxxxx>]

Folks,
I am attempting to write a Dissector for DOCSIS 1.1 based on the 
Specifications at:
http://www.cablemodem.com/specifications.html

Captures can be obtained from Cisco Cable Modem Termination Systems, using 
the Cable Monitor Command:

http://www.cisco.com/univercd/cc/td/doc/product/cable/cab_rout/cmtsfg/ufg_cmon.htm

I am currently having trouble deciding how to decide a Frame is a DOCSIS 
frame or not.  Looking at the problem more closely, I cannot see a 
reasonable way of differentiating a DOCSIS frame from a normal Ethernet 
frame, since the packets a captured from an Fast Ethernet interface off of 
the CMTS.  I've decided to add an Encapsulation type for DOCSIS and have 
this enabled by a global preference.  My question is this:  Does anyone see 
any unintended consequences of this approach?  For example, would there 
need to be any special handling for saving captures to a non-ethereal format?

Thanks in advance,
Anand


--
Anand V. Narwani,  CCIE 3892
Advanced Engineering Services
Cisco Systems, Inc.
Direct/Fax: 919.392.3404
Email: anarwani@xxxxxxxxx

"Meddle not in the affairs of dragons, for you are crunchy and taste good 
with ketchup"