https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6082
--- Comment #1 from Guy Harris <guy@xxxxxxxxxxxx> 2011-08-26 03:04:53 PDT ---
The very notion of a heuristic dissector running directly atop the "frame"
dissector is nonsensical; the contents of the frame depend on the link-layer
type of the frame; you don't know whether the frame is an Ethernet frame or an
802.11 frame or an 802.11 frame with a radiotap header or an 802.11 frame with
a PRISM header or a Token Ring frame or an FDDI frame or a PPP frame or a BSD
loopback interface frame or a raw IP frame or an ATM AAL5 frame with some
particular flavor of pseudo-header or....
If Hilscher made the huge mistake of putting into a pcap file with a link-layer
type of 1 (LINKTYPE_ETHERNET/DLT_EN10MB) frames that have a
netANALYZER-specific header, followed by a regular Ethernet frame, that's their
mistake, not ours; if they want to put their frames into pcap files, they
should request a LINKTYPE_/DLT_ value for their packets from
tcpdump-workers@xxxxxxxxxxxxxxxxx, and contribute code for Wireshark that adds
a new WTAP_ENCAP_ value for that LINKTYPE_ value, maps that LINKTYPE_ value to
the new WTAP_ENCAP_ value, and adds a dissector for that WTAP_ENCAP_ value.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
