If netcat respects packet boundaries, would it be possible to avoid
writing a dissector? I verified that netcat does not add its own
headers beyond the standard UDP header nor does it fragment writes over
multiple UDP frames.
Dave
-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx]
Sent: Monday, June 28, 2004 6:50 PM
To: Craig, Dave
Cc: ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Nesting protocols
Craig, Dave said:
> For instance, I pipe pppd through netcat for UDP encapsulation. Is
there a
> way to get ethereal to decode the PPP frames encapsulated in UDP
frames?
You'd have to write a dissector to decode the netcat encapsulation,
which
looks as if it might involve extracting frames from a sequence of bytes
and removing frame terminator bytes and escape bytes. That's likely to
be
a bit painful. as you might have to do reassembly across UDP packet
boundaries (if a PPP packet is split across packet boundaries) or
dissect
more than one PPP packet in a UDP packet.
There's no way to get Ethereal to do that *without* writing code.
