Wireshark-dev: Re: [Wireshark-dev] Adding support for LINKTYPE_PPP_ETHER/DLT_PPP_ETHER?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 27 Feb 2012 15:06:57 -0800
On Feb 27, 2012, at 1:40 PM, Reinhard Speyerer wrote:

> I recently noticed that Wireshark does not seem to support pcap files
> with DLT 51 (LINKTYPE_PPP_ETHER/DLT_PPP_ETHER) which is used by the
> in-kernel PPPoE implementation (pppoe(4)) in NetBSD and OpenBSD:
> 
> $ tshark -r pppoe0-sample-2.pcap # TShark 1.6.5
> ...
> tshark: The file "pppoe0-sample-2.pcap" is a capture for a network type that TShark doesn't support.
> (pcap: network type 51 unknown or unsupported)
> 
> From looking at the format Wireshark should be able to handle this
> DLT using the existing pppoes dissector.
> 
> Please advise whether I should add a corresponding enhancement request
> for Wireshark.

You might as well, as long as it's always guaranteed to be encapsulated in the exact same format (DON'T GET ME STARTED on DLT_PFLOG!).  If you submit it with a patch, that'd be even better.  "Wireshark can read XXX" generally beats "Wireshark can read YYY so it can read XXX after you run it through XXX-to-YYY".