Wireshark · Ethereal-dev: [Ethereal-dev] Broken Wellfleet LAPB captures ...

[Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>]

Hi, 

OK, so the problem seems to be that the capture claims to be a NG Sniffer 
capture, but wiretap cannot figure out what type it is, so it labels them 
as WTAP_DLT_LAPB frames, it seems.

The solution would be to declare a Wellfleet DLT type and detect it there, 
and then have a WellFleet dissector that chews the first two bytes, builds 
a TVB containing the rest and calls the Etherenet dissector, because the 
rest seems to be pseudo-Frame-type Ethernet frames.

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com