On Sat, Jun 22, 2002 at 09:04:14PM -0400, Anand V. Narwani wrote:
> I am attempting to write a Dissector for DOCSIS 1.1 based on the
> Specifications at:
> http://www.cablemodem.com/specifications.html
>
> Captures can be obtained from Cisco Cable Modem Termination Systems, using
> the Cable Monitor Command:
>
> http://www.cisco.com/univercd/cc/td/doc/product/cable/cab_rout/cmtsfg/ufg_cmon.htm
>
> I am currently having trouble deciding how to decide a Frame is a DOCSIS
> frame or not.
What do you mean by "a DOCSIS frame"?
> Looking at the problem more closely, I cannot see a
> reasonable way of differentiating a DOCSIS frame from a normal Ethernet
> frame, since the packets a captured from an Fast Ethernet interface off of
> the CMTS.
If the frames are being transmitted over Ethernet, then either
1) the machine transmitting them is violating the 802.3 spec
or
2) the frames are 802.3 frames, with either a length field and
an 802.2 LLC header or with an Ethernet type field.
In the former case, you'll need a global "they're violating the spec"
preference.
In the latter case, there's no problem - presumably there are either LLC
DSAP and/or SSAP values, or Ethernet type values, for the particular
special frames (as opposed to, say, boring old IP frames) being sent out
over the wire.
