On Mon, 28 Feb 2000, Guy Harris wrote:
> Well, the first thing you'd need for a LAT decoder would be a
> specification of the LAT protocol...
>
> ...unfortunately, DEC have never published it.
>
> In fact, the LBL version of tcpdump *doesn't* understand LAT - all it
> does is hand off packets with an Ethertype of ETHERTYPE_LAT to the
> default printer.
Well, reverse engineered implementations do exist, as I seem to remember
one company forced to take a license as a result of legal action
(TSSnet?). Back when I was interested in DEC gear, I looked into LAT and
while I didn't find it trivial to implement the protocol, reading some of
the protocol from a packet trace wasn't prohibitively hard (remember, the
protocol had to be fast, and powerful as the MicroVAX 2000 was, it
couldn't afford losing too many cycles). Oh, and the microfiches helped!
> DECNet, on the other hand, is documented; see
>
> http://gatekeeper.dec.com/pub/DEC/DECnet/PhaseIV/
And fun to do as well :-) Forget PhaseV though. I don't think any
customer of DEC got their network converted before TCP/IP took over.
As an easy first start, decoding the Ethernet address of a DECnet host
into a node number would be fun. Name resolution without resorting to
snooping would be harder but even if done by snooping would be very useful
in corporate networks (hmmm, as I'm writing this I realize I haven't even
checked if Ethereal does some decoding already). Another fun and somewhat
useful mini project is to decode the cluster protocol (it's not formally
documented either, but easy to reverse engineer).
Even to this date I occasionally have to resort to a sniffer to find out
who is blowing up the cluster.
Anyway, to the original poster: start with an easy bit to get acquainted
with Ethereals innards. From there on, it becomes a matter of coding your
freshly discovered info on the protocol. This approach worked for me!
Cheers,
-- Bert
Bert Driehuis, MIS -- bert_driehuis@xxxxxxxxxxxxxxxx -- +31-20-3116119
Hi! I'm a signature virus! Copy me to your .signature and help me spread!