Wireshark · Ethereal-dev: Re: [Ethereal-dev] Trying to dissect LAPBether ...

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Wed, Dec 27, 2000 at 01:54:13AM +1000, Richard Sharpe wrote:
> There is a LAPB driver for Ethernet, lapbether, available for Linux, which
> allows Linux to Linux LAPB over ethernet, over which you can shove X.25 ...
> 
> I am trying to dissect it; it is carried in frames of type 0x6000, an
> unused type allocated to DEC.
> 
> It seems that there is a two byte length on the front of each frame ...
> 
> Anyone know anything about it?

>From "drivers/net/lapbether.c":

/*
 *	Receive a LAPB frame via an ethernet interface.
 */
static int lapbeth_rcv(struct sk_buff *skb, struct device *dev, struct packet_type *ptype)
{
	int len, err;
	struct lapbethdev *lapbeth;

	skb->sk = NULL;		/* Initially we don't know who it's for */
	
	dev = lapbeth_get_x25_dev(dev);

	if (dev == NULL || dev->start == 0) {
		kfree_skb(skb);
		return 0;
	}

	lapbeth = (struct lapbethdev *)dev->priv;

	lapbeth->stats.rx_packets++;

	len = skb->data[0] + skb->data[1] * 256;

	skb_pull(skb, 2);	/* Remove the length bytes */
	skb_trim(skb, len);	/* Set the length of the data */

	if ((err = lapb_data_received(lapbeth, skb)) != LAPB_OK) {
		kfree_skb(skb);
		printk(KERN_DEBUG "lapbether: lapb_data_received err - %d\n", err);
	}

	return 0;
}

If I'm correctly interpreting the lines

	len = skb->data[0] + skb->data[1] * 256;

	skb_pull(skb, 2);	/* Remove the length bytes */
	skb_trim(skb, len);	/* Set the length of the data */

	if ((err = lapb_data_received(lapbeth, skb)) != LAPB_OK) {

and correctly interpreting "lapb_data_received()", "lapb_data_input()",
and "lapb_decode()", the frame appears to be a two-byte length field (in
little-endian byte order), followed by a one-byte address field
(LAPB_ADDR_{A,B,C,D}), from "include/net/lapb.h", followed by the
control field of the LAPD header.

I think this means you get the length field, use it to construct the
next tvbuff, and hand the frame to "dissect_lapb()".