Wireshark-bugs: [Wireshark-bugs] [Bug 9552] Support Novell SPXII packet dissection
Comment # 7
on bug 9552
from Joshua Kinard
From my understanding of IPX, it acts as both a layer 3 protocol (carrying a
transport-layer protocol, like SPX or NCP), and it can also be a layer 4
protocol and carry payload directly. In fact, it seems from looking at various
IPX captures I've made over the past few months, that IPX is generally used as
both layer 3/4 protocols. SPX is rare, SPXII even rarer. If you do backup
runs via SBACKUP or RCONSOLE, then you'll get SPX/SPXII traffic, but old
Win/DOS games (Warcraft II, Masters of Orion, MechWarrior, etc) package their
data directly underneath the IPX layer. Then you've got other IPX transport
protocols like NCP (NetWare Core Protocol for NDS/eDirectory), RIP (which has
its own color rule under "SMB"), SAP, and NLSP.
I think the balance to strike would be to include it in the default set, but
make it disabled instead of enabled. Would that impact the GUI at all? I am
assuming that the color rules are selected and applied via the display filter
syntax, and I have seen where complex syntax slows down packet processing a
bit. IPX/SPX is effectively a dead protocol these days (Linux dumped SPX
support in early 2.5.x, and I've had trouble using plain IPX in modern
kernels).
You are receiving this mail because:
- You are watching all bug changes.
