Wireshark-dev: Re: [Wireshark-dev] Introducing an FT_OUI type, should it be an integer or bytes
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 19 Aug 2017 17:23:05 -0700
On Aug 19, 2017, at 4:18 PM, Richard Sharpe <realrichardsharpe@xxxxxxxxx> wrote:

> I have a change up for review that introduces a new type, FT_OUI.
> 
> It works. However, the big question is that it changes the current
> practice from the OUI being an INT24 to being BYTES.
> 
> This breaks backward compatibility I imagine.
> 
> Is this a big issue?

Some issues I see are:

	1) Filter expressions that compare an OUI field against a 24-bit integral value might become invalid - but you might be able to make that work by allowing FT_OUI be represented, in filters, either as an integral value or as 3 octets (allowing 0C0102, 0C:01:02, etc.).

	2) OUIs are used in the 802.2 LLC dissector when processing the SNAP header; a dissector can register a field to use for the PID for a given OUI, and a dissector table to be used for the PID's value, passing llc_add_oui() an integral value for the OUI.  We could continue to allow that, and just convert the 3-octet value to an integral value in the 802.2 dissector and use that integral value to look up the registered information.