Wireshark-users: Re: [Wireshark-users] LAPD decode problem
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 23 Jul 2009 15:19:42 -0700

On Jul 22, 2009, at 6:00 AM, Harvey, James B. wrote:


You might, however, try one of the "user DLT" values (147 through
162), and tell Wireshark to dissect that value with the "lapd"
dissector.
** I will experiment with that. Is there a way to tell Wireshark to start decoding at a fixed byte offset so I could just skip the LAPD header?
No, but, given that Wireshark has a LAPD dissector, there shouldn't be a need to do so. 


The only LAPD I see in bpf.h is type 177


That's DLT_LINUX_LAPD; to quote the comment
so it won't work for normal raw LAPD.


and Wireshark won't even load a file converted with that.
You must have an old version of Wireshark - current versions should be 
able to read that.
** Using 1.2 and it didn't. I would guess the Linux DLT has more or fewer bytes so the conversion resulted in a garbage header.
By "won't even load a file" do you mean Wireshark won't even open the file and show packets, even as garbage, or do you mean it opens the file and displays the packets, but it doesn't dissect them correctly?
I'd expect the latter with 1.2, if you'd converted the file to DLT_LINUX_LAPD, as the Linux DLT does, in fact, have some extra stuff in front of the LAPD header. I would *not* expect the former.