Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Link type proposal, IEEE 802.1Qbu Frame Preemption Protocol

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 30 Nov 2017 02:10:00 -0800
On Nov 30, 2017, at 1:42 AM, Anton Glukhov <anton.a.glukhov@xxxxxxxxx> wrote:

> I've been working for IEEE802.1Qbu Frame Preemption Protocol and now it's part of TSN set of protocols. I would like to propose the new link type and sent this proposal to tcpdump-workers@xxxxxxxxxxxxxxxxx, but unfortunately no response.

It's hard to respond to a message that was never delivered. :-)

If you're not subscribed to tcpdump-workers, a message you send to the list is put in a moderation queue; your message might be in the queue, and the moderator might not have gotten around to releasing it.  (I don't know how to manage the moderation queue; I found an e-mail message indicating that I'd received the moderation password, but I couldn't find anything on how moderation was done, and have long since forgotten both the password and the procedure for releasing messages.)

It's not a very busy list, so you won't get flooded by e-mail if you subscribe.  According to the archives:

	http://seclists.org/tcpdump/

in the busiest 3-month period since 2002, 377 messages arrived, for an average of a little more than 4 messages per day.  Recently, it's been more like 30-60 messages in a 3-month period, which is less than one message per day.

Instructions on subscribing can be found at

	http://www.tcpdump.org/#mailing-lists

I"m CCing the tcpdump-workers list.

> I'm working for Frame Preemption Protocol(IEEE 802.1Qbu), which is part of Time-Sensitive Networking(TSN) set of standards. The protocol has very interesting extension of standard Ethernet frame and I'd like to propose to add the new link-layer type. Here are the reasons:
> - protocol uses non-standard ethernet preamble, user must see the type of frame/fragment

LINKTYPE_ETHERNET frames don't include the preamble, so a preempting frame with a different preamble would look, in an LINKTYPE_ETHERNET capture, exactly like a non-preempting frame.

Are you saying that you want a variant of LINKTYPE_ETHERNET, in which the MAC header is preceded by something that indicates whether this is a regular or a preempting frame, so that captures with this link-layer header type can include both regular and preempting frames?

> - protocol uses specific CRC sum. It's called mCRC and depends on preamble, which means the type of frame/fragment

LINKTYPE_ETHERNET may, but aren't guaranteed to, include the CRC; to properly check the CRC, the additional metadata giving the frame type would be required, so it knows whether it's a regular or modified CRC.