Wireshark · Ethereal-dev: Re: [Ethereal-dev] is it possible to capture the traffic on STM-1/E1 ?-> NBAP/RNSAP

[LEGO <luis.ontanon@xxxxxxxxx>]

On 2/3/06, Guy Harris <gharris@xxxxxxxxx> wrote:
> Anders Broman wrote:
>
> > NBAP/RNSAP can currently only be dissected using a user DLT which you can
> >  use with a Tectronix K12xx file for instance.
>
> If you mean K12 binary files, they don't have DLT values; are you
> referring to text files being converted to libpcap files, with a user
> DLT value?
>
> Is there a way to do that without modifying the Ethereal source?

When I was working on the K12 file format as a byproduct I came out
with packet-user_encap.c which allows the user to set which protocol
to decode user DLTs. As it was handy I decided to check it in. (I work
more often with unencapsulated PDUs gotten from logs than with actual
frames taken from the wire).

By the way, with Lua one will bee able to do

    wtap_encap = DissectorTables.get("wtap_encap");
    nbap = Dissector.get("nbap")
    udp_port:add(3456,nbap)

 -- or

    udp_port = DissectorTables.get("udp.port");
    h248 = Dissector.get("h248")
    udp_port:add(1234,h248)

That at thee very least is a way to have a persistent decode-as setting.

--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan