Wireshark-users: Re: [Wireshark-users] Question about parsing raw MTP3

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 4 Oct 2006 18:41:24 +0200 (CEST)

Hi,

On Wed, 4 Oct 2006, Guy Harris wrote:

> Anders Broman wrote:
>
> > I think you should use a DLT value of:
>
> 	...
>
> > #define DLT_MTP3  141                 /* MTP3, without pseudo-header or MTP2 */
>
> He wants his pcap file to have 141 as the link-layer type, to have it
> interpreted as raw MTP3; if he used, for example, 1, i.e. DLT_EN10MB,
> Wireshark (and Ethereal, and tcpdump, and...) would interpret the file
> as Ethernet, as that's what the link-layer type value says it is.
>
> > And possibly a
> >
> > #define WTAP_ENCAP_MTP2    42
> >
> > #define WTAP_ENCAP_MTP3    43
>
> Those are values used internally in Wireshark, not in files; a pcap
> link-layer type value of 141 maps to a WTAP_ENCAP value of 43.

So..........

His problem can be solved in two ways.
Either his program prepends a fake Ethernet header etc.
Or his program writes stuff to a text2pcap compatible text file and use
that program to prepend the fake headers for him.

Thanx,
Jaap