Ethereal-dev: Re: [Ethereal-dev] updated fakelink dissector + (new) README.fakelink

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>
Date: Tue, 8 Jul 2003 14:44:02 -0700 (PDT)
OK, rather than calling it a fake-link, why not a raw capture. We have precedent from the various raw protocol support on some versions of UNIX (which unfortunately seems to have meant raw-IP).
Secondly, rather than having a 16-bit protocol type, how about a 32-bit protocol type which would allow us to, say map IP-types and port-numbers etc without having to resort to more large tables. 

Of, how about having a variable length type with:

  First field being DLT-TYPE
  Second field being a sub-type based on that
  Third field being ...

Thus, a raw IP capture might have header types of:

 0x0006 0x0001 0x0805 <capture-len> <data>
      ^      ^    ^
      |      |    |
      |      |    +----- IP ...
      |      +---------- DLT_EN10MB (ethernet II?)
      +----------------- 6-bytes total type info

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, sharpe[at]ethereal.com, http://www.richardsharpe.com