Wireshark · Ethereal-dev: Re: [Ethereal-dev] Dissector for DOCSIS

["Anand V. Narwani" <anarwani@xxxxxxxxx>]

Hi Guy,
I've looked at the libpcap code and I don't see a clean way of adding a new 
DLT_ type tell libpcap that I need to force it to use that type.   So I 
decided to go with the Ethernet-specific preference... the only problem is 
that DOCSIS encapsulated frames contain Ethernet frames.  This has the 
effect of causing the DOCSIS dissector to be called when you don't want it 
to be called: when you are inside a DOCSIS frame decoding the Ethernet frame.
In my original method, I tested for the preference inside dissect_frame() 
and simply set
pinfo->fd->lnk_t = WTAP_ENCAP_DOCSIS.

One possibility is to keep it an Ethernet preference, but the check is done 
in dissect_frame().  I don't really like that solution, but the alternative 
is to make it a "Global" preference (see screen shot).  Any ideas will be 
more than welcome.

Thanks in advance,
Anand

At 03:11 PM 6/23/2002 -0700, Guy Harris wrote:
> Instead, I think the right answer might be to have an Ethernet-specific
> preference that causes the Ethernet dissector to hand the frame to the
> DOCSIS dissector, and just use WTAP_ENCAP_ETHERNET for those files.

--
Anand V. Narwani,  CCIE 3892
Advanced Engineering Services
Cisco Systems, Inc.
Direct/Fax: 919.392.3404
Email: anarwani@xxxxxxxxx

"Meddle not in the affairs of dragons, for you are crunchy and taste good 
with ketchup"

Attachment: prefs.jpg
Description: JPEG image