[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Apr 03, 2002 at 03:31:09PM +0200, Marcin Gryszkalis wrote:
> tethereal 0.9.3, with GLib 1.2.10, with libpcap 0.7, with libz 1.1.3, 
> without UCD SNMP, FreeBSD 4.5 stable
> 
> I think the packet is bad (I don't think I have anything on x.25 here.

No, the packet isn't bad - it just happens to have been sent to or from
1998, which is the port for RFC 1613 X.25-over-TCP.

There is a bug, but it'll take a little work to fix (the problem is that
the X.25 dissector assumes that the direction of the packet - DTE->DCE,
or DCE->DCE - is available in a "pseudo-header" from the packet trace,
but that's not the case for X.25-over-TCP on top of Boring Old Ethernet,
so we need to have another mechanism for supplying the direction flag;
the right way is probably to have all dissectors that call the X.25
dissector supply the flag as part of "private data" pointed to by
"pinfo->private_data", with the LAPB dissector taking the flag from the
pseudo-header and putting it in an X.25-specific structure, and the XOT
dissector computing the flag based on whether the packet is going to or
coming from the X.25-over-TCP port).