Sid Sid said:
> As I can see you completely rewrote(or probably,recreated) Presentation
> dissector.
> The reason is not clear for me.
Perhaps it's because he was apparently using (based on the RCS/CVS version
strings in the dissectors he sent) Ethereal 0.10.0 or 0.10.0a, and that
version of Ethereal didn't have your Presentation dissector.
> Regarding trace file that you have send me:
> I do not know MMS protocol very well
One of his dissectors referred to "IEC GSSE", which appears to be an
electrical utility control protocol ("generic substation event model"),
and Googling for
MMS OID 9506
found
http://www.cl.cam.ac.uk/~mgk25/osi-faq.txt
which says, among other things:
The Manufacturing Message Specification (MMS) Service and Protocol have
been defined for controlling and integrating industrial automation
systems (ISO 9506).
so that's presumably the protocol to which he's referring (and he
presumably has an MMS dissector somewhere). SISCO are in the business of
computer-based industrial control, and have MMS software:
http://www.sisconet.com/mms_products.htm
> but as I can see from trace it
> nevertheless uses ACSE protocol too.
Googling for
MMS ACSE 9506
found
http://www.nettedautomation.com/standardization/ISO/TC184/SC5/WG2/mms_syntax/
which says
MMS.TXT - This file contains the four ASN.1 modules published in the
second edition text in which the IF - ENDIF blocks have been removed.
This file has been tested for syntactic conformity with ASN.1 standard
by parsing with the OSS ASN.1 parser. This file contains references to
elements defined in the ACSE standard. Therefore, when compiling this
program by itself, an ASN.1 compiler will complain of unsatisfied
references.
ACSE.TXT - This file was created solely to satisfy the ACSE references
in MMS.TXT so that an ASN.1 compiler will not complain. In any real
application, this file should be replaced with a file supplying real
links to ACSE (or ACSE-like) support facilities.
which seem to suggest that MMS does use ACSE.
However, the ACSE dissector *also* wasn't in 0.10.0 or 0.10.0a, so it
sounds as if he *really* should be using a newer version of Ethereal if
he's developing an MMS dissector - several of the protocol dissectors he
needs would be in 0.10.3 but not in 0.10.0.