Wireshark · Ethereal-dev: Re: [Ethereal-dev] Can't open Sniffer trace

["Martin Regner" <martin.regner@xxxxxxxxx>]

Guy Harris wrote:

>
>On Monday, July 7, 2003, at 8:57 AM, Greg Morris wrote:
>
>> Here are the same problem trace files in Lanalyzer format.
>
>Well, they're Ethernet captures, but with a network type other than 
>what we've seen in NetXRay/Windows Sniffer captures.
>
>I have a change that treats the network type as a 1-byte field rather 
>than a 2-byte field, and that checks the byte *after* the network type 
>- if it's 2, it treats the network type as an NDIS type value, and if 
>it's 0, it treats it as an NDIS type value - 1, which should handle all 
>the captures with 0 the same as it always has, and treats your two 
>captures as Ethernet.
>
>I treat all other values for that byte as errors.
>
>I don't know what significance, if any, that byte has.
>
>I've attached a patch with the change.
>
>BTW, there are some packets in the server capture (such as the first 
>two) with an IP protocol type of 0xe0; any idea what they are? 

NAI Sniffer shows IP proto 224 (0xe0) as "?"
So no clue there.

      IP:       .... ..0. = ECT bit - transport protocol will ignore the CE bit
      IP:       .... ...0 = CE bit - no congestion
      IP: Total length    = 80 bytes
      IP: Identification  = 64689
      IP: Flags           = 0X
      IP:       .0.. .... = may fragment
      IP:       ..0. .... = last fragment
      IP: Fragment offset = 0 bytes
      IP: Time to live    = 128 seconds/hops
      IP: Protocol        = 224 (?)
      IP: Header checksum = 3B45 (correct)
      IP: Source address      = [160.63.224.152]


> (There are also some SNAP packets with an OUI of 0x00000c, for Cisco, and a 
>protocol ID of 0x2004; does anybody know what *those* are?)

NAI Sniffer showed them like below. But as you see "Unknown DISL message type; 25 bytes uninterpreted"

- - - - - - - - - - - - - - - - - - - - Frame 21 - - - - - - - - - - - - - - - - - - - -
ISL: ----- ISL Protocol Packet -----
      ISL: 
      ISL: Destination Address               = 01000C0000
      ISL: Type                              = 0 (Ethernet)
      ISL: User                              = 0 (Normal)
      ISL: Source Address                    = 000912DB7B4B
      ISL: Length                            = 80
      ISL: Constant value                    = 0xAAAA03
      ISL: Vendor ID                         = 0x000912
      ISL: Virtual LAN ID (VLAN)             = 1
      ISL: Bridge Protocol Data Unit (BPDU)  = 1
      ISL: Port Index                        = 141
      ISL: Reserved
      ISL: 
ETHER: ----- Ethernet Header -----
      ETHER: 
      ETHER: Destination = Multicast 01000CCCCCCC
      ETHER: Source      = Station 000912DB7B4B
      ETHER: 802.3 length = 50
      ETHER: 
LLC:  ----- LLC Header -----
      LLC:  
      LLC:  DSAP Address = AA, DSAP IG Bit = 00 (Individual Address)
      LLC:  SSAP Address = AA, SSAP CR Bit = 00 (Command)
      LLC:  Unnumbered frame: UI
      LLC:  
SNAP: ----- SNAP Header -----
      SNAP: 
      SNAP: Vendor ID = Cisco1
      SNAP: Type = 2004 (DISL)
      SNAP: 
DISL: ----- Cisco Dynamic Inter-Switch Link (DISL) Packet -----
      DISL: 
      DISL: Version                = 1
      DISL: 
      DISL: Message type           = 0x0001 (Domain Name)
      DISL: Message length         = 11
      DISL: Management domain name = "KAPOZH"
      DISL: 
      DISL: Message type           = 0x0002 (Status)
      DISL: Message length         = 5
      DISL: Status flag = 04
      DISL:   0... .... = Operational state is not trunk
      DISL:   .... .100   = Configured state: port in default auto mode
      DISL: 
      DISL: Message type           = 0x0003 (Unknown)
      DISL: Message length         = 5
      DISL: Unknown DISL message type; 25 bytes uninterpreted
ADDR  HEX                                               ASCII
0000: 01 00 0c 00 00 00 00 09 12 db 7b 4b 00 50 aa aa | ....... .Û{K.P..
0010: 03 00 09 12 00 03 00 8d 00 00 01 00 0c cc cc cc | .. .............
0020: 00 09 12 db 7b 4b 00 32 aa aa 03 00 00 0c 20 04 | . .Û{K.2...... .
0030: 01 00 01 00 0b 4b 41 50 4f 5a 48 00 00 02 00 05 | .....KAPOZH.....
0040: 04 00 03 00 05 a5 00 04 00 0a 00 09 12 db 7b 4b | .....¥..... .Û{K
0050: 00 00 00 00 00 00 00 00 00 00 83 e1 26 93       | ...........á&.



- - - - - - - - - - - - - - - - - - - - Frame 51 - - - - - - - - - - - - - - - - - - - -
DISL: ----- Cisco Dynamic Inter-Switch Link (DISL) Packet -----
      DISL: 
      DISL: Destination Address    = 01000CCCCCCC
      DISL: Source Address         = 000BFDFF254C
      DISL: Message length         = 43
      DISL: ----- Pseudo LLC/SNAP Portion -----
      DISL: 
      DISL: LLC                    = 0xAAAA03
      DISL: SNAP Org ID            = 0x00000C (Cisco)
      DISL: 
      DISL: HDLC Protocol Type     = 0x2004
      DISL: Version                = 1
      DISL: 
      DISL: Message type           = 0x0001 (Domain Name)
      DISL: Message length         = 14
      DISL: Management domain name = "KAPOSIKA1"
      DISL: 
      DISL: Message type           = 0x0002 (Status)
      DISL: Message length         = 5
      DISL: Status flag = 03
      DISL:   0... .... = Operational state is not trunk
      DISL:   .... .011   = Configured state: port would like to become trunk
      DISL: 
      DISL: Message type           = 0x0003 (Unknown)
      DISL: Message length         = 5
      DISL: Unknown DISL message type; 14 bytes uninterpreted
ADDR  HEX                                               ASCII
0000: 01 00 0c cc cc cc 00 0b fd ff 25 4c 00 2b aa aa | ........ý.%L.+..
0010: 03 00 00 0c 20 04 01 00 01 00 0e 4b 41 50 4f 53 | .... ......KAPOS
0020: 49 4b 41 31 00 00 02 00 05 03 00 03 00 05 a5 00 | IKA1..........¥.
0030: 04 00 0a 00 0b fd ff 25 4c 00 00 00             | .....ý.%L...




- - - - - - - - - - - - - - - - - - - - Frame 52 - - - - - - - - - - - - - - - - - - - -
ISL: ----- ISL Protocol Packet -----
      ISL: 
      ISL: Destination Address               = 01000C0000
      ISL: Type                              = 0 (Ethernet)
      ISL: User                              = 0 (Normal)
      ISL: Source Address                    = 000BFDFF254C
      ISL: Length                            = 76
      ISL: Constant value                    = 0xAAAA03
      ISL: Vendor ID                         = 0x00000C
      ISL: Virtual LAN ID (VLAN)             = 1
      ISL: Bridge Protocol Data Unit (BPDU)  = 1
      ISL: Port Index                        = 0
      ISL: Reserved
      ISL: 
ETHER: ----- Ethernet Header -----
      ETHER: 
      ETHER: Destination = Multicast 01000CCCCCCC
      ETHER: Source      = Station 000BFDFF254C
      ETHER: 802.3 length = 43
      ETHER: 
LLC:  ----- LLC Header -----
      LLC:  
      LLC:  DSAP Address = AA, DSAP IG Bit = 00 (Individual Address)
      LLC:  SSAP Address = AA, SSAP CR Bit = 00 (Command)
      LLC:  Unnumbered frame: UI
      LLC:  
SNAP: ----- SNAP Header -----
      SNAP: 
      SNAP: Vendor ID = Cisco1
      SNAP: Type = 2004 (DISL)
      SNAP: 
DISL: ----- Cisco Dynamic Inter-Switch Link (DISL) Packet -----
      DISL: 
      DISL: Version                = 1
      DISL: 
      DISL: Message type           = 0x0001 (Domain Name)
      DISL: Message length         = 14
      DISL: Management domain name = "KAPOSIKA1"
      DISL: 
      DISL: Message type           = 0x0002 (Status)
      DISL: Message length         = 5
      DISL: Status flag = 03
      DISL:   0... .... = Operational state is not trunk
      DISL:   .... .011   = Configured state: port would like to become trunk
      DISL: 
      DISL: Message type           = 0x0003 (Unknown)
      DISL: Message length         = 5
      DISL: Unknown DISL message type; 18 bytes uninterpreted
ADDR  HEX                                               ASCII
0000: 01 00 0c 00 00 00 00 0b fd ff 25 4c 00 4c aa aa | ........ý.%L.L..
0010: 03 00 00 0c 00 03 00 00 00 00 01 00 0c cc cc cc | ................
0020: 00 0b fd ff 25 4c 00 2b aa aa 03 00 00 0c 20 04 | ..ý.%L.+...... .
0030: 01 00 01 00 0e 4b 41 50 4f 53 49 4b 41 31 00 00 | .....KAPOSIKA1..
0040: 02 00 05 03 00 03 00 05 a5 00 04 00 0a 00 0b fd | ........¥......ý
0050: ff 25 4c 00 00 00 6b 3b 30 54                   | .%L...k;0T