Hi
I'd like to be able to capture packets from a non-supported
transport and transfer them to Ethereal for decoding.
Specifically I would like to be able to display packet transfers
across a RapidIO link. I have written a utility to generate
trace files in libpcap format and a dissector to the RapidIO
transport layer.
The problem that I am running into is how to communicate
the transport type to Ethereal. There is no "DLT_" value for
this transport, and therefore Ethereal has no knowledge of
where to start when decoding the file.
One approach to this problem would be to create a new
Data Link Type called "DLT_NAMED" and add an additional
parameter to the libpcap file header, as follows:
// "libpcap" file header
struct pcap_hdr {
uint32 magic; // magic number
uint16 version_major; // major version number
uint16 version_minor; // minor version number
int32 thiszone; // GMT to local correction
uint32 sigfigs; // accuracy of timestamps
uint32 snaplen; // max length of captured packets
uint32 network; // data link type = DLT_NAMED
char dlt_name[]; // data link protocol name
};
The dlt_name parameter would be the PROTOABBREV name
used by the protocol dissector. Using this mechanism users could
easily add support for new data links for Ethereal such as RapidIO,
PCI Express etc.
Am I missing something? Is there an easier way to do this?
Any feedback would be appreciated.
Kent Dahlgren
