Hi list,
Yes there is a protocol ID in the IP header that tells
ethereal that this is MAC in MAC encapsulation.
Furthermore the IP header had slitghtly different
fields than the normal IP haeder so it seemed
justified to alter IP.c in order to intercept ethereal
at the IP level. Furthermore the IP header has 6
octets added to it, which are not part of the classic
IP header. My question is, though, are my calls going
to the the ethernet dissector after I have stripped
off the outer two layers and why am I getting
MALFORMED IP header if the calls are going to the
ethernet dissector after the outer two layers have
been dissected.
All the best
Charles
--- Gilbert Ramirez <gilbertr@xxxxxxxxx> wrote:
> I don't understand why you're stripping off the
> outer mac and IP
> headers. Why not just let the normal dissectors do
> their jobs of
> calling the next dissector? Is there an IP protocol
> number which lets
> the IP dissector know to pass the payload to the
> ethernet dissector?
>
> --gilbert
>
> On 8/30/05, Charles Wilkinson
> <c_s_wilkinson@xxxxxxxxxxx> wrote:
> > Hi list, need some info on dissecting mac tunnels.
> > Optical is a protocol that encapsulates ethernet
> > frames in another ethernet frame with an IP
> header. so
> > we have:
> >
> > MAC-IP-MAC-trailers. I've stripped off the outer
> mac
> > and IP and am trying to call the ethernet disector
> to
> > break up the innner mac frame. Here's the code
> >
> > static dissector_handle_t eth_handle;
> > eth_handle = find_dissector("eth");
> > int available_length = tvb_length(tvb) - 26;/*20
> for
> > the ip header and 6 for the TLS*/
> > int reported_length = hlen - 26;
> > next_tvb = tvb_new_subset(
> > tvb,
> > 26,
> > MIN(available_length,
> reported_length),
> > reported_length
> > );
> > call_dissector(eth_handle, next_tvb, pinfo,
> > parent_tree);
> > return;
> >
> > All I get is [malformed IP Packet] after the first
> two
> > layers (i.e. the ouer MAc and IP) so it is calling
> the
> > eth dissector and it doesn't crash but it isn't
> > dissecting the inner ethernet and all the rest of
> the
> > layers above it.
> > Interesting problem, pls help.
> > I have also a problem concerning display of non
> byte
> > alligned data, the 6 bit post.
> > Please help as this protocol is going to be widely
> > used and dissection is important.
> > All the best
> > Charles
> >
> > contact: c_s_wilkinson@xxxxxxxxxxx
> >
> >
> >
> >
>
___________________________________________________________
> > To help you stay safe and secure online, we've
> developed the all new Yahoo! Security Centre.
> http://uk.security.yahoo.com
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> >
>
http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
>
http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
___________________________________________________________
To help you stay safe and secure online, we've developed the all new Yahoo! Security Centre. http://uk.security.yahoo.com
