Ethereal-dev: Re: [Ethereal-dev] [Q] about dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 26 Jul 2002 02:22:44 -0700
On Sun, Jul 21, 2002 at 02:16:40PM +0200, Thomas Irmen wrote:
> > On Sat, Jul 20, 2002 at 10:44:01PM +0200, ti wrote:
> > > line coding level, so its like you see it on the line.
> > 
> > So does that mean you're recording the encoded stuff actually being
> > carried on the medium, rather than the octets that the host transmitting
> > the packet sent?
> 
> Thats true. Encoded stuff recorded and (line)decoded by software.
> But I�m not sure what you�re meaning exactly, �cause my english is NOT so
> good :-)
> 
> Whats the difference?

The difference I was thinking of was the difference between un-decoded
stuff from the medium (i.e., a string of bits as appear on the wire, at
least for media where bits are what gets sent over the wire, unlike,
say, 100BASE-T4, with 8B6T, although I guess you could represent a T as
2 bits) and decoded stuff from the medium (i.e., a string of bits closer
to what the host told the device to transmit).

At least as I read IEEE Std 802.3, SOP is sent on the medium as a
"special code group" K27.7; it has an "Octet Value" of FB, but an actual
octet of FB is sent on the wire as code group D27.7, which has a
different encoding on the medium from K27.7.

So if you're recording decoded stuff (octet values), the SOP would look
like 0xFB, and would be indistinguishable from a byte value of 0xFB in
the data.  If you're recording un-decoded stuff, you could distinguish
them - but you'd have to decode them inside Ethereal.

EOP would be similar - it's K29.7, which is 0xFD, like D29.7, but with a
different encoding from D29.7.