Wireshark-dev: Re: [Wireshark-dev] Windows 8 Mobile Broadband interface model interface types
From: Guy Harris <[email protected]>
Date: Sun, 28 Apr 2013 12:33:20 -0700
On Apr 28, 2013, at 12:13 PM, Guy Harris <[email protected]> wrote:

> On Apr 28, 2013, at 8:32 AM, Evan Huus <[email protected]> wrote:
> 
>> ... (this will likely involve adding a new linktype to the official list [2]).
>> 
>> Once that is done we can add a dissector to Wireshark for the framing
>> protocol,
> 
> ...both of which will be necessary only if they do something different from the "add a fake Ethernet header with special Ethertypes for PPP packets" hack that they've done in the past for PPP; we already dissect that.

The spec given appears to talk only about low-level USB stuff, not about how it plugs into the networking stack, so the W8 changes probably would not require any changes in WinPcap.

The document on Windows *7* changes to mobile broadband:

	http://msdn.microsoft.com/en-us/library/windows/hardware/gg454521.aspx

*does* indicate that there's a new NDIS medium type, NdisMediumWirelessWan, and that the packets show up as raw IP frames.  There's already a link-layer type for raw IP, DLT_RAW, and we already have a dissector for it, so the only change needed to WinPcap would be:

	support for mapping NdisMediumWirelessWan to DLT_RAW;

	doing whatever's necessary to be able to see those devices in the first place;

and the latter is probably the biggest part.  I don't know whether the WinPcap NDIS driver would have to plug into the networking stack in a different fashion in order to make that work; it might have to.  That would be a very significant change.