Ok, I'm not subscribed to the list, but there was something I noticed about
past versions of ethereal that someone could fix easily.
Right now, if you detect TP4 on top of IP (IP protocol field of
IP_PROTO_TP), you just list an IP packet with some extra info listing TP and
the protocol ID.
COTP is the same as TP4, and implemented in packet-clnp.c. If, in addition
to how its already configured, if you register that as IP protocol
IP_PROTO_TP, you get TP4 parsing (and SESSION parsing if I remember right)
automatically.
No, its not used much, but since its an allowed protocol, it would be
something else to add support for pretty easily. I can't provide code
myself, as I did a modification like this for an internal-use-only version
at work (yeah, yeah, I can't redistribute it at all, which is kinda
disappointing, but what can you do) and the company I work for wouldn't be
interested in relinquishing the copyright. I can at least talk about the
idea, as that isn't copyrightable :)
Jeff