Attached is the patch for the discussed heuristics.
/rene
On Tue, 2005-10-04 at 10:34 -0700, Guy Harris wrote:
Rene Pilz wrote:
> I would propose this algorithm:
> a) if aal5 len < 14 bytes then dissect as sscop
> b) if aal5 len >= 14 bytes and the fist byte is 0x81 or 0x83 then
> dissect as sscop
>
> As I have seen until now, there should be no MAC address collision with
> this solution.
The lowermost bit of the first octet of a MAC address is the
individual/group bit, so that'd only collide with a multicast address
beginning with 0x81/0x83; I think most of the standard ones, at least,
seem to start with 0x01.
> Is it fine for you?
> Should I also consider Q.2931 as you proposed?
The heuristics you mention should be sufficient.
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
--
Dipl-Ing (FH) MSc. C.E René Pilz
ftw. Telekommunications Research Center Vienna http://www.ftw.at
Tech Gate Vienna, Donaucitystraße 1, A-1220 Wien
Mobile: +43 664 8269871 Office: +43 1 5052830-13 Fax: +43 1 5052830-99
|
Index: wiretap/atm.c
===================================================================
--- wiretap/atm.c (revision 16117)
+++ wiretap/atm.c (working copy)
@@ -81,6 +81,21 @@
* multiplexed RFC 1483 traffic.
*/
pseudo_header->atm.type = TRAF_LLCMX;
+ } else if (pseudo_header->atm.aal5t_len < 14) {
+ /*
+ * As this cannot be an ethernet frame
+ * (less than 14 bytes) we can try it
+ * as a SSCOP frame
+ */
+ pseudo_header->atm.aal = AAL_SIGNALLING;
+ } else if (pd[0] == 0x83 || pd[0] == 0x81) {
+ /*
+ * MTP3b headers often encapsulate
+ * a SCCP or MTN in the 3G network.
+ * This should cause 0x83 or 0x81
+ * in the first byte.
+ */
+ pseudo_header->atm.aal = AAL_SIGNALLING;
} else {
/*
* Assume it's LANE.
