Wireshark · Wireshark-dev: Re: [Wireshark-dev] Selecting Decoders from Wiretap

[Guy Harris <guy@xxxxxxxxxxxx>]

Rolf Fiedler wrote:
> Hi,
>
> some time ago I added the EyeSDN trace format to the wiretap library and
> it works fine for the main application, ISDN tracing. D channel data is
> decoded as Q.931 and B channel data is passed to PPP/IP decoding. All
> this works fine.
>
> Now we have added a number of applications:
> a) ATM tracing on E1 lines (we have raw cell capture incl. ATM headers)
> b) SS7 signalling on E1 lines
> c) X.25 on B channels of E1 lines
>
> In each of these applications, Wireshark can not select the proper
> decoder because we fail to tell it which decoder to use.

If you have an {ATM, SS7, X.25} capture, is that a characteristic of the 
file (such that all the packets in the file are {ATM cells, MTP2(?) 
packets, LAPB(?) packets), or do different packets have different 
contents (so that a capture can mix multiple types of packet)?

A comment in wiretap/eyesdn.c says:

 * Each Frame starts with the 0xff Flag byte
 * - Bytes 0-2: timestamp (long usec in network byte order)
 * - Bytes 3-7: timestamp (40bits sec since 1970 in network byte order)
 * - Byte 8: channel (0 for D channel, 1-30 for B1-B30,
 *     128 ATM cells, 129 ATM layer indications)
 * - Byte 9: Sender (0 NT, 1 TE)
 * - Byte 10-11: frame size in bytes
 * - Byte 12-n: Frame Payload

which suggests that a capture can mix multiple types of packets, with 
different channel numbers indicating the type of packet.

Is that the way the ATM tracing is done?  What about SS7 (is that MTP2 
or some other layer?) and X.25?

If it's done that way, you should use WTAP_ENCAP_PER_PACKET as the 
encapsulation type, and set wth->phdr.pkt_encap to the appropriate 
encapsulation value in eyesdn_read() (WTAP_ENCAP_ISDN for ISDN, 
WTAP_ENCAP_ATM_PDUS or WTAP_ENCAP_ATM_PDUS_UNTRUNCATED with the 
appropriate pseudo-header for ATM, WTAP_ENCAP_MTP2/etc. for SS7, 
WTAP_ENCAP_LAPB for X.25 if it's LAPB).

> Now my question:
> Is there a way to dynamically select the decoder in the Wiretap module?
> If I manually select ISUP as decoder (for SS7 traces), I receive
> "unknown WTAP_ENCAP 17" (17 is ISDN, which I selected in our wiretap
> module).
>
> What I really would like to have is that the user can select the
> decoding format depending on the knowledge of the data she captured.

I.e., the file doesn't *specify* what type of data is in the packet?

> Is
> this possible? Which WTAP_ENCAP is necessary in this case?
>
> At the moment I could specify a different WTAP_ENCAP type for the D
> channel, the B channel and for ATM traces. But the trace file does not
> contain information about D channel protocol (SS7 or Q.931 for instance)
> or B channel protocol (e.g. X.25 or PPP).

OK, so it does specify for ATM, but not for other captures.

> What is the best way to solve this? What would be the best WTAP_ENCAP
> type for
> the D channel,
> the B channel and
> ATM cells?

For ATM cells, it'd be WTAP_ENCAP_ATM_PDUS or 
WTAP_ENCAP_ATM_PDUS_UNTRUNCATED with the appropriate pseudo-header.

For the others, there isn't one.  Either a new mechanism that allows 
options to be passed to the Wiretap module would need to be added, with 
the Eyesdn module specifying an option to select the B-channel and 
D-channel protocols, or you'd have to, for example, add a 
WTAP_ENCAP_EYESDN encapsulation, with a dissector that has an option or 
options to select the B-channel or D-channel protocols.