> On Thu, Oct 10, 2002 at 03:28:26PM -0700, Chris Waters wrote:
> > I have attached a dissector and a patch to wiretap for a new protocol.
The
> > Tazmen Sniffer Protocol is a proprietary protocol for encapsulating
packets
> > captured by remote packet sniffers.
>
> Is it a *protocol* or a *file format*?
>
> I.e., it sets itself up as a link-layer protocol, but what physical
> networks implement it?
It is a protocol. The purpose of the protocol is to carry information that a
packet sniffer might capture in addition to the packet data. The current use
is for the 802.11 per packet data that is not contained in the 802.11
headers: signal strength, noise level, channel number, FCS and WEP status,
etc. If the packet sniffer is remote then TZSP might be carried over UDP, if
it is on the local machine then TZSP will be the first protocol in the chain
and will appear to be a link layer.
> > I have arbitrarily assigned a pcap encapsulation number so that raw TZSP
> > packets can be saved in libpcap files.
>
> As Gilbert noted, you shouldn't do that - encapsulation number 124 is
> already reserved.
My intention was that someone who knew how these numbers are allocated would
choose the next free one. It appears that the next free DLT is 127. I am
still not clear how to have a DLT allocated. Should I submit a patch to
libpcap at tcpdump.org?
Thanks,
Chris.
