Not sure on the plugin issue, but you may want to consider just adding a
small amount of support for this to packet-vlan.c, from what I
understand ISL is _VERY_ similar to 802.1q VLANs. packet-vlan.c does
802.1q vlans w/ all the special handling required for the extra
ethertypes.
This raises an issue - do we have any policy on when stuff should be a
plugin?
-- Nathan
Paul Ionescu wrote:
>
> Hello developers,
>
> I want to make a plugin for dissecting cisco ISL frames.
> It is not hard to implement it, but I don't know how to set some
> variables in the plugin.
>
> const gchar version[] = "0.1";
> const gchar desc[] = "Cisco Inter-Switch Link";
> const gchar protocol[] = "???";
> const gchar filter_string[] = "???";
>
> For instance, what should I put in protocol[] and in filter_string[]
> to enable my plugin to receive all the packets?
>
> I tried to look in packet-gryphon.c, but I don't get it. There is
> protocol[]="tcp" and filter_string[]="tcp.port==7000".
> So, I tried in my plugin to put protoco[]="eth" and
> filter_string[]="eth" to pass me all the traffic, but nothing came to
> me.
> The pluging in registered and is working because I have tested it with
> protoco[]="tcp" and filter_string[]="tcp.port==5000" and
> the trafic for tcp port 5000 was coming in my plugin and gets
> dissected.
>
> ISL is a Cisco proprietary Vlan tagging and, in order to decode it, I
> have to process the whole traffic, take every frame, and
> interpret the ISL header (12 bytes) and to pass the remaining frame to
> dissect_eth().
>
> I see no other way to interpret ISL frames, but maybe I am wrong.
>
> Cheers,
> Paul Ionescu.
>
>
--
------------------------------------------------------------
Nathan Neulinger EMail: nneul@xxxxxxx
University of Missouri - Rolla Phone: (573) 341-4841
CIS - Systems Programming Fax: (573) 341-4216
