Wireshark · Ethereal-dev: Re: [Ethereal-dev] v0.9.9 through v0.10.7 can't recognize Cisco ISL frames

[Guy Harris <gharris@xxxxxxxxx>]

Jim Young wrote:

> I'm quite too naive with this project to know how best to fix this.  
> Would moving the "Oh, Yuck" section out of the initial "if" and
> into an additional "else if" test be the way to go? 

The way to go is probably to check for ISL frames before doing any of 
the other checks; I've checked in a change to do that, as well as to 
handle 0C-00-0C-00-00.

> > ISL
> >    Destination: 01:00:0c:00:00:07 (01:00:0c:00:00:07)
> >    0000 .... = Type: Ethernet (0)
> >    .... 0111 = User: Unknown (7)
> >    Source: 00:02:fd:2c:b8:97 (Cisco_2c:b8:97)
> >    Length: 0
> >    DSAP: 0xAA
> >    SSAP: 0xAA
> >    Control: 0x3
> >    HSA: 0x000000
> >    0000 0000 0000 001. = VLAN ID: 0x0001
> >    .... .... .... ...1 = BPDU: Yes
> >    Index: 0
> >    CRC: 0xb8970000

The length field is the one causing the problem with the current 
dissector.  Is it supposed to be zero?  According to the ISL document at 
the URL you sent, it "stores the actual packet size of the original 
packet as a 16-bit value. The LEN field represents the length of the 
packet in bytes excluding the DA, TYPE, USER, SA, LEN, and FCS fields. 
The total length of the excluded fields is 18 bytes, so the LEN field 
represents the total length minus 18 bytes."  That seems to suggest that 
there's actually no encapsulated packet of any sort past the FCS (CRC) 
field.