Wireshark-dev: Re: [Wireshark-dev] New dissector: Veritas Low Latency Transport(LLT)
From: "Anders Broman" <[email protected]>
Date: Thu, 17 Aug 2006 23:02:09 +0200
Please also add a comment that the Ethertype isn't IEEE assigned...

-----Ursprungligt meddelande-----
Från: [email protected]
[mailto:[email protected]] För ronnie sahlberg
Skickat: den 17 augusti 2006 22:44
Till: Developer support list for Wireshark
Ämne: Re: [Wireshark-dev] New dissector: Veritas Low Latency Transport(LLT)

you have to terminate all value_strings with a {0,NULL} else
val_to_str() and friends will read beyond the end of the array.

do not encapsulate the dissection of all the fields inside an if(tree)
since this may prevent display filters from working.

i can do these changes later tonight

On 8/17/06, Stephen Fisher <[email protected]> wrote:
> Attached is a patch file that adds a new dissector for the LLT protocol
> (Veritas Low Level Transport, used for server clustering).  They use
> ethertype 0xCAFE even though it isn't assigned to them :(.  There are
> other fields and possibly other message types directly between servers
> it does not yet dissect as no one outside of Veritas knows what they
> are.  This dissector understands the one people will run across most -
> multiple servers broadcasting these heartbeats all over the place.  I
> figured out these fields through many Internet searches.
> I will add the protocol to the Wiki after it is committed.
> Thanks,
>   Steve
Wireshark-dev mailing list
[email protected]