On Dec 2, 2003, at 11:46 PM, Alex V. Boreskoff wrote:
Sorry for stupid question,
but how can I subscribe my dissector on LLC/SNAP
This -
dissector_add ( "llc.dsap", 0xAA, hMyDissector );
does not work
If the protocol for which you're writing a dissector is using a DSAP of
0xAA (and thus preventing any SNAP-based protocol from running on any
machine on which it's running!), you would have to modify the LLC
dissector not to check for a DSAP and an SSAP of 0xAA (a modification
that will not be in the official Ethereal releases, so you'd have to
maintain your own private version of Ethereal - but, then, protocols
shouldn't use 0xAA in any case) and then use that "dissector_add()"
call.
If, however, the protocol for which you're writing a dissector is using
LLC/SNAP in the way it's supposed to be written, you would *NOT* use
that "dissector_add()" call, which you wouldn't want to do *anyway*,
because you don't want to have to dissect the SNAP header yourself, you
want the Ethereal LLC dissector to do it for you.
If the protocol has an Ethernet type assigned to it, you'd just do
dissector_add("ethertype", {the Ethernet type value}, hMyDissector);
If the protocol has a SNAP PID assigned to it for use with some OUI
*other* than the 00:00:00 used for Ethernet types, and that OUI is not
one of the ones for which we already have support (00:00:0C and
00:00:F8 for Cisco, 00:00:81 for Nortel, 08:00:07 for Appletalk,
00:80:C2 for MAC frames bridged over ATM or Frame Relay, or 00:E0:2F
for DOCSIS spanning tree), you'd:
create a file to handle that OUI, similar to "packet-cisco-oui.c" or
"packet-nt-oui.c", which would create a dissector table for protocol
IDs for that OUI;
register your dissector in that dissector table with
dissector_add({that dissector table's name}, {the protocol's PID},
hMyDissector);
If the protocol has a PID for 00:00:0C, you'd do
dissector_add("llc.cisco_pid", {the protocol's PID}, hMyDissector);
If the protocol has a PID for 00:00:81, you'd do
dissector_add("llc.nortel_pid", {the protocol's PID}, hMyDissector);
If the protocol has a PID for 00:00:F8, those appear to be Ethernet
types, and you'd do
dissector_add("ethertype", {the protocol's PID}, hMyDissector);
and the same applies for 08:00:07.
For 00:80:C2 or 00:E0:2F, you'd have to modify "packet-llc.c".
