Wireshark-dev: Re: [Wireshark-dev] Parallel Redundancy Protocol (PRP) dissector
From: Jeff Morriss <[email protected]>
Date: Mon, 16 Apr 2007 16:26:11 +0800

Meier Sven (msv) wrote:
This is a dissector for the Parallel Redundancy Protocol (PRP) defined in chapter 6 of the IEC 62439.
PRP uses two independent networks in parallel and allows redundancy 
without switchovers.
The protocol is sending Mac multicast messages with Ethertype 0x88fb. In 
addition to that it adds to every Ethernet frame a 4 byte trailer before 
the FCS. The trailer is detected by checking a size field and an 
identifier which are part of the trailer. Therefore, if the last 4 bytes 
of a frame match a correct trailer they get interpreted as a trailer, 
although it was probably not a real one.
Is there some way to know if the trailer is going to be there without 
searching for it?  As it is, registered as a postdissector (didn't even 
know those existed until now), this dissector will get called for every 
frame--which seems a bit excessive to me.
If there's no way to know ahead of time, maybe this dissector should be 
disabled by default, though I'm not sure how to best go about doing that.