Ethereal-users: Re: [Ethereal-users] Ethereal on W2K POS/ATM Captures (alternatively on Linux)
On Tue, Nov 05, 2002 at 05:10:15AM -0500, mrmartin1903@xxxxxxxxxxxx wrote:
> For ATM there only seem to be options for RFC1483 and RFC1577
> available.
That's really one option - that's DLT_ATM_RFC1483, with a "-l" value of
100.
> I will have to find out if that is enough. If you know of
> any more options for ATM encapsulations please let me know.
The other option is DLT_SUNATM, with a "-l" value of 123, supported by
recent versions of Ethereal. In that encapsulation, the packet data
includes:
a 4-byte ATM pseudo-header;
an ATM AAL5/Signalling AAL PDU.
The pseudo-header is 4 bytes long, and contains, in order:
a 1-byte flag byte;
a 1-byte VPI value;
a 2-byte *big-endian* (network byte order) VCI value.
The uppermost bit of the flag byte (i.e., the 0x80 bit) is 1 if the
packet was sent to the DCE (switch, etc.) and 0 if the packet was
received from the DCE.
The lower 4 bits of the flag byte indicate the type of traffic; the
traffic type values Ethereal can handle are:
1 ATM LANE - the PDU is a LANE packet, beginning
with the 2-byte LE Client/marker value, followed
by the LE Control packet or encapsulated
Ethernet packet
2 RFC 1483 LLC-multiplexed traffic - the PDU
begins with an 802.2 LLC header
5 ILMI - the PDU is an SNMP PDU for ILMI
6 Q.2931 - the PDU is a Q.2931 message, beginning
with the protocol discriminator for Q.2931, and
with the SSCOP trailer at the end
