Wireshark-users: Re: [Wireshark-users] Stripping DOCSIS stuff out

From: "Frank Bulk" <frnkblk@xxxxxxxxx>
Date: Wed, 9 Aug 2006 19:34:50 -0500

Thanks for the quick response.  Sounds like it wouldn't be an easy thing to
do.  Perhaps a small project for a DOCSIS advocate out there. =)

Frank

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx] 
Sent: Wednesday, August 09, 2006 7:27 PM
To: frnkblk@xxxxxxxxx; Community support list for Wireshark
Subject: Re: [Wireshark-users] Stripping DOCSIS stuff out


On Aug 9, 2006, at 3:30 PM, Frank Bulk wrote:

> I'm using the Sigtek ST-261B to capture some PacketCable VoIP  
> traffic, and I
> would really like to use a protocol analyzer other than Ethereal.   
> There are
> others that can import libpcap files, but they don't understand the  
> DOCSIS
> stuff.
>
> Is there a way I can strip the DOCSIS layer out so that the file  
> becomes
> acceptable?

Yes, but you'd have to write your own code to do it.

You'd also have to worry about reassembling Ethernet packets  
fragmented across multiple DOCSIS packets, as I understand it.