Ethereal-dev: Re: [Ethereal-dev] Re: FW1 monitor dissector patch

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 13 Jul 2002 12:39:24 -0700
On Sat, Jul 13, 2002 at 02:28:25PM +0200, Alfred Koebler wrote:
> > Should FW1 monitor files be handled by the Ethernet dissector checking
> > the "interpret_as_fw1_monitor" flag and, if it's set, displaying the
> > direction and interface name rather than the MAC addresses?
> Yes, that's the way.

If there can be 802.3 packets (as opposed to Ethernet II packets; i.e.,
packets with a 2-byte length field, usually followed by an 802.2 header,
rather than packets with a 2-byte type field) in FW1 monitor files,
doing it that way - i.e., using the Ethernet dissector's code to handle
the 2 bytes after the 12-byte Firewall-1 header - that would handle
802.3 packets correctly.

By the way, your previous patch had

	#define        TYPE_ETHER      0x0
	#define        TYPE_TR         0x1
	#define        TYPE_FDDI       0x2
	#define        TYPE_ATM        0x3

in "packet-fw1.c", but didn't appear to use them; are those values that
appear in the 12-byte FW1 header (e.g., in the second byte), or are
those just values you were using internally but aren't using any more?