Wireshark · Ethereal-dev: Re: SV: [Fwd: [Ethereal-dev] 3G Signaling patch]

[Guy Harris <gharris@xxxxxxxxx>]

Guy Harris wrote:

> Unfortunately, having atm_guess_lane_type() check for 802.3 frames by 
> checking the type/length field as if it's a length field, and set the 
> traffic type to something other than LANE if it doesn't look like an 
> 802.3 frame, means that
>
>     1) Ethernet frames with a type field don't get recognized as LANE 
> frames

A heuristic that checks for packets that look like signalling packets 
might work better - if the signalling is Q.2931, then checking for 09 xx 
 xx xx xx {Q.2931 message type} might work.  (There don't appear to be 
a lot of known Ethernet types in the 0x09xx range.)  The byte after the 
protocol discriminator is the call reference length, so the heuristics 
might also check for small values in the second byte.