Another question: Is it possible to directly give a packet to Layer 3 or even
to a protocol? I'm thinking of a scenario where I have got a hex dump of a
RSVP message from a router. It doesn't have an Ethernet or IP header
associated with it. I want to decode this packet as an RSVP packet. The
"Decode As" menu option doesn't seem to allow for this. It just seems to allow
you to switch the protocol used at Layer 2 and Layer 3.
A couple of ways I think this can be done:
- Have a menu option to control the hexdump decoder and have it insert fake
Ethernet and IP headers into the packet.
- Allow the user to include lines in the hexdump file to include fake Ethernet
and IP headers. Something like this:
#WIRETAP HEADER Ethernet
#WIRETAP HEADER IP
00000000 00 E0 1E A7 05 6F 00 10 5A A0 B9 12 08 00 46 00 .....o..Z.....F.
00000010 03 68 00 00 00 00 0A 2E EE 33 0F 19 08 7F 0F 19 .h.......3.....
00000020 03 80 94 04 00 00 10 01 16 A2 0A 00 03 50 00 0C .............P..
Thoughts? Alternatives?
-Ashok
On Tue, 24 Apr 2001 17:12:17 -0500, "Gilbert Ramirez" <gram@xxxxxxxxxx> wrote:
> Yes, this would be a useful addition to the wiretap library. I often
> wished wiretap could do this, and once I even started coding something.
> What would be useful, I think, would be the ability to add some text
> to the top of the hex dump file to indicate things like the default
> encapsulation type (with the possibility of doing a per-frame
> encapsulation type if you wanted). Also, a text-mask would be nice
> so you could tell the hexdump wiretap module to look at only a certain
> portion of each line, thus ignoreing the address on the left and the ASCII
> display on the right.
>
> --gilbert
>
> ----- Original Message -----
> From: "Ashok Narayanan" <ashokn@xxxxxxxxx>
> To: <ethereal-dev@xxxxxxxxxxxx>
> Sent: Tuesday, April 24, 2001 4:59 PM
> Subject: [Ethereal-dev] Can we decode hex dumps?
>
>
> > Folks,
> >
> > I've seen a couple of places where I have received a hex dump of a packet,
> in
> > this common hex dump format:
> >
> > 00000000 00 E0 1E A7 05 6F 00 10 5A A0 B9 12 08 00 46 00 .....o..Z.....F.
> > 00000010 03 68 00 00 00 00 0A 2E EE 33 0F 19 08 7F 0F 19 .h.......3.....
> > 00000020 03 80 94 04 00 00 10 01 16 A2 0A 00 03 50 00 0C .............P..
> > 00000030 01 01 0F 19 03 80 11 01 1E 61 00 0C 03 01 0F 19 .........a......
> >
> > It would be useful to have a decoder that could read this sort of thing
> > directly as a
> > packet; one could then use the "Decode packet as" feature to decode the
> data
> > as a specific type of packet. If something like this doesn't already
> exist, I
> > will write one.
> >
> > Thoughts?
> > -Ashok
> >
> >
> >
> > --- Asok the Intern ----------------------------------------
> > Ashok Narayanan
> > IOS Network Protocols, Cisco Systems
> > 250 Apollo Drive, Chelmsford, MA 01824
> > Ph: 978-244-8387. Fax: 978-244-8126 (Attn: Ashok Narayanan)
> >
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
--- Asok the Intern ----------------------------------------
Ashok Narayanan
IOS Network Protocols, Cisco Systems
250 Apollo Drive, Chelmsford, MA 01824
Ph: 978-244-8387. Fax: 978-244-8126 (Attn: Ashok Narayanan)
