Wireshark · Ethereal-dev: Re: [Ethereal-dev] Support for pure protocol packetswithout underlying protocol data

[Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>]

On Thu, 2003-07-03 at 15:34, Jeff Morriss wrote:
> 
> 

> 
> You mean one DLT value for each protocol?  That seems like a lot.

It's okay; we're not going to run out of integers any time soon.

> 
> > However, a further issue is that at any future time, people might want to 
> > create a capture file of only some higher layer PDUs, like, for example 
> > SMB PDUs without any link layer, network layer or transport layer headers.
> >  
> > Having a flexible scheme to deal with this would be useful.
> 
> By having a "fake link" header that has a "type" (protocol) field you 
> can put any protocol in there.  You can even mix protocols:  packet 1 is 
> MTP2, packet 2 is SCCP, packet 3 is MTP3, packet 4 is SMB.
> 
> Of course, people will have to reserve their fakelink.type's just like 
> people reserve DLT_ values.

Which just creates another problem. You might as well use the
"infrastructure" setup for DLT values...i.e., ask the tcpdump-workers
group.

--gilbert