Wireshark-users: Re: [Wireshark-users] Question about parsing raw MTP3

From: "Keith Fleming" <kfleming@xxxxxxxxxxxxxxxxxx>
Date: Wed, 4 Oct 2006 12:03:13 -0500

Actually, the intermediate C program that takes the raw MTP3 hex data
put a 0x8d in the "link level type" 16-bit field and that fixed it!

Thanks!



-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
Sent: Wednesday, October 04, 2006 12:41 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Question about parsing raw MTP3

Hi,

On Wed, 4 Oct 2006, Guy Harris wrote:

> Anders Broman wrote:
>
> > I think you should use a DLT value of:
>
> 	...
>
> > #define DLT_MTP3  141                 /* MTP3, without pseudo-header
or MTP2 */
>
> He wants his pcap file to have 141 as the link-layer type, to have it
> interpreted as raw MTP3; if he used, for example, 1, i.e. DLT_EN10MB,
> Wireshark (and Ethereal, and tcpdump, and...) would interpret the file
> as Ethernet, as that's what the link-layer type value says it is.
>
> > And possibly a
> >
> > #define WTAP_ENCAP_MTP2    42
> >
> > #define WTAP_ENCAP_MTP3    43
>
> Those are values used internally in Wireshark, not in files; a pcap
> link-layer type value of 141 maps to a WTAP_ENCAP value of 43.

So..........

His problem can be solved in two ways.
Either his program prepends a fake Ethernet header etc.
Or his program writes stuff to a text2pcap compatible text file and use
that program to prepend the fake headers for him.

Thanx,
Jaap


_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users

The information contained in this message may be confidential to Kodiak Networks, Inc. and its subsidiaries and protected from disclosure. If this message did not reach the intended recipient, or an employee or agent responsible for delivering it to the intended recipient, you are hereby informed that any distribution or copying of this communication is prohibited. If you have received this communication in error, please notify us immediately by replying to the sender of the message and then delete the message. Thank you.