Wireshark-dev: Re: [Wireshark-dev] X.25, LAPB, PLP Decoding
From: Jaap Keuter <[email protected]>
Date: Mon, 18 Jun 2007 20:35:31 +0200
Hi Mirko,

Please refer to http://wiki.wireshark.org/Development/LibpcapFileFormat about this subject.

[email protected] wrote:

I’ve been making Protocol Analyzer based on Sangoma S5142A synch serial card and WireShark. Capturing of X.25 LAPB and PLP layers is done by Sangoma card/driver. Storing into file is done by socket based code. File format is libpcap file format.
I’ve seen that WireShark  (wtap)  has decoder for LAPB and PLP layers 
of the original X.25.
Problem is that libpcap “DLT_    “ definitions doesn’t have value for 
LAPB link layer. So, when I opened captured file by WireShark, I can see 
only raw data.
I think that I should define proprietary “DLT_LAPB” value and do 
whatever necessary steps in wtap (WireShark) in order to recognize my 
DLT_LAPB type form libpcap file header. After that I should be able to 
see LAPB frames and PLP packets in the WireShark.
Is above story about new DLT_LAPB and wtap extension is correct?

Mirko Karanovic.
Toronto Transit Comission