Wireshark · Ethereal-dev: Re: SV: [Fwd: [Ethereal-dev] 3G Signaling patch]

[Guy Harris <gharris@xxxxxxxxx>]

Rene Pilz wrote:

> I would propose this algorithm:
> a) if aal5 len < 14 bytes then dissect as sscop
> b) if aal5 len >= 14 bytes and the fist byte is 0x81 or 0x83 then 
> dissect as sscop
>
> As I have seen until now, there should be no MAC address collision with 
> this solution.

The lowermost bit of the first octet of a MAC address is the 
individual/group bit, so that'd only collide with a multicast address 
beginning with 0x81/0x83; I think most of the standard ones, at least, 
seem to start with 0x01.

> Is it fine for you?
> Should I also consider Q.2931 as you proposed?

The heuristics you mention should be sufficient.