Ethereal-dev: Re: [Ethereal-dev] Dissector for DOCSIS

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Sun, 23 Jun 2002 04:58:58 +0200
On Sun, Jun 23, 2002 at 03:39:05AM +0200, Joerg Mayer wrote:
> I'Ve looked at this too and to me it looks like the first few bytes are
> something DOCSIS specific and the rest looks like an ethernet frame (if
> the first byte == c3 then few == 8, c0: 6, c2: 6). Just an idea.

After looking at the docsis 1.1 spec (SP-RFIv1.1-I08-020301.pdf, printed
page number 58ff, page in doc 76ff), I can see that the guess was ok.
Looking at the spec, it should be possible to write a heuristic dissector
that decides whether the packet has a docsis header or not, although that
would be quite expensive - if the problem is resolved that way, this
dissector should be turned off by default.

  Ciao
        Jörg

PS: The spec can be found at: http://www.cablemodem.com/specifications.html

--
Joerg Mayer                                          <jmayer@xxxxxxxxx>
I found out that "pro" means "instead of" (as in proconsul). Now I know
what proactive means.