Charles Wilkinson wrote:
Hi list, need some info on dissecting mac tunnels.
Optical is a protocol that encapsulates ethernet
frames in another ethernet frame with an IP header.
Presumably this isn't RFC 3378 Ethernet-in-IP, as Ethereal already has a
dissector for that.
so we have:
MAC-IP-MAC-trailers. I've stripped off the outer mac
and IP
As Gilbert says, there's no need to strip anything off. The outer MAC
layer is dissected by some Ethereal dissector, which, for IP packets,
strips off the MAC header and supplies the remaining data to the IP
dissector.
Presumably there's some IP protocol number assigned to Nortel's
encapsulation; the dissector for this encapsulation protocol should
register itself in the "ip.proto" dissector table with that IP protocol
number, in which case the IP dissector will, for those protocols, strip
off the IP header and hand the remaining data to your dissector.
and am trying to call the ethernet disector to
break up the innner mac frame.
So what's the contents of the IP payload for this encapsulation? Is
there a header in front of the Ethernet packet (as is the case for RFC
3378 Ethernet-in-IP), or is the Ethernet packet directly encapsulated
inside the IP datagram (in which case the Ethernet dissector should just
register itself with that IP protocol type).
I have also a problem concerning display of non byte
alligned data, the 6 bit post.
So are those 6 bits part of a header that precedes the Ethernet packet
inside the IP datagram? If so, then this is the first of the cases I
mentioned above, so you'd need your own dissector for this protocol.
If the 6-bit field is at a fixed offset in the packet, you'd do it as a
bit field; look for "bitfield" in the "doc/README.developer" file for
information on bit fields.
