[Guy Harris <gharris@xxxxxxxxx>]

LEGO wrote:

> It was AAL5 on the wire. the encapsulation it is not in the file. I
> have just the sscop trailer and the payload if any.

Payload followed by trailer?

> > Then have "proto_reg_handoff_sscop()" in packet-sscop.c register
> > "dissect_sscop()" in the "wtap_encap" dissector table with the new
> > WTAP_ENCAP value.
>
> Actually the new WTAP_ENCAP valueS because there can be many types of
> payload (mtp3/mtp2, mtp3b/sscop, h248/sscop, x/ethernet, and more...)
> in that format (Tektronix k12's .rf5),

(Is this reading text files or binary files?)

In those examples, is the protocol listed after the "/" the lowest-level 
protocol?

If so, then MTP3/MTP2 and x/Ethernet don't need new WTAP_ENCAP values - 
we already have "raw MTP2" and Ethernet encapsulations.

Would the only difference between MTP3b/SSCOP and H.248/SSCOP be the 
protocol running atop SSCOP?

> SSCOP is the anomalous case
> because I need to "split" the packet before and then pass the payload
> to one dissector and the rest of it to sscop.

Why?  Why can't the SSCOP dissector process the trailer and then hand 
off to the other dissector?