Wireshark · Wireshark-users: Re: [Wireshark-users] OpenBSD enc0 capture from tcpdump failes to decode

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 25, 2009, at 1:05 PM, Brad Guillory wrote:

> Making this change and recompiling works with unmodified capture
> files.  Does the final solution need to be done here: ./epan/
> dissectors/packet-enc.c?

No - no packet-XXX.c file knows about pcap link-layer types (well,  
other than packet-ppi.c, but that's because the packet "data" includes  
a header with a pcap link-layer type), they know about Wireshark's  
internal encapsulation types (because Wireshark reads non-pcap files  
as well).

> It seems to me that if we make the change above it might break
> something for someone.

Yes, it'll break something for people trying to read BSD/OS RFC 1483- 
encapsulated ATM files on BSD/OS, if there are any of them left. :-)

I guess we could replace that code with

#if defined(DLT_ATM_RFC1483) && (DLT_ATM_RFC1483 == 13)
	{ 13,		WTAP_ENCAP_ATM_RFC1483 },
#else
	{ 13,		WTAP_ENCAP_ENC },
#endif

so that it still as before for people trying to read BSD/OS RFC 1483- 
encapsulated ATM files on BSD/OS and treats 13 as meaning "OpenBSD  
IPsec encapsulation" everywhere else - it's not as if it handled BSD/ 
OS SLIP on any platforms, so it's not as if we break that.