Noam Kedar wrote:
I'm trying to convert a capture file of an ATM/AAL5 traffic to a TCP
dump file (pcap).
I took the AAL5 payload (LLC/ SNAP / Ethernet II / IPv4) and
encapsulated it in an Ethernet frame.
Why not just take the AAL5 payload and convert it to, well, an AAL5
payload? See, for example, DLT_ATM_RFC1483 (but use 100, rather than 11
or 14 or whatever, as the value; unfortunately, not all BSDs have the
same value for DLT_ATM_RFC1483, but 100 is, at least by Ethereal,
supported as such a file).
The result is a bridged LLC frame of the form: Ethernet header/ LLC /
SNAP / Ethernet II / IPv4.
There is a problem when the IP datagram size is 1500 bytes, since then
the total payload of the base Ethernet frame is 1524 Bytes.
Ethertype <= 1500 (0x05DC) indicates an LLC frame,
Correct. That's what the IEEE 802.3 standard specifies.
and the actual value indicates the length of the LLC frame.
In this case the LLC frame size is greater than 1500.
So what does the IEEE 802.3 standard say should be done in this case?
Unfortunately, what I suspect it says is "don't do that", which is why
Ethereal isn't letting you do that.
Is there any Ethertype that indicates an LLC frame and would be
recognized by Ethereral? (Ethereal does not recognize the EtherType
0x0002 of LLC)
0x0002 isn't an Ethertype - it's <= 1500.
Is there another encapsulation method that I can use?
Yes - DLT_ATM_RFC1483. The AAL5 payload would be the packet content,
with *no* extra encapsulation.
(You could also use DLT_SUNATM, if you happen to have the VPI/VCI as well.)