["Martin Regner" <martin.regner@xxxxxxxxx>]

Matthew Bradley wrote:

>I've done some more investigation. The protocol is an ICL (a brand now
>subsumed into Fujitsu) protocol called OSLAN (try a Google search on OSLAN
>protocol). OSLAN is, as Dave was describing, TP4 over 802.3; I don't know
>about the null CLNP stuff.
>
>OSLAN is in widespread use in the UK - wherever there is an ICL mainframe.
>This tends to be government organisations or organisations with a government
>legacy, like ourselves.
>
>I've attached a capture of some sample activity.
>
>The capture starts with four connections disconnecting, then the four
>reconnecting, then a test message down the connection, then all four
>connections closing again.


It looks like it is COTP over CLNP inactive subset ("CLNP null") but the SAP in the LLC is not 0xFE.
http://www.protocols.com/pbook/iso.htm

I haven't found so much useful info about OSLAN yet, but in this document there was some OSLAN packets.
http://users.iclway.co.uk/jpress/papers/lea.htm

If you have possibilities to compile Ethereal yourself you could make a temporar fix in packet-osi.c, by adding
       dissector_add("llc.dsap", 0x54, osi_handle);
      dissector_add("llc.dsap", 0x14, osi_handle);
in proto_reg_handoff_osi(void)

I have sent you the result I got after applying that fix (in a separate mail), so you can see if it looks correct.
Below is a couple of packets.


Frame 1 (60 bytes on wire, 60 bytes captured)
    Arrival Time: May 23, 2003 19:07:19.926310000
    Time delta from previous packet: 0.000000000 seconds
    Time relative to first packet: 0.000000000 seconds
    Frame Number: 1
    Packet Length: 60 bytes
    Capture Length: 60 bytes
    File Offset: 40 (0x28)
IEEE 802.3 Ethernet 
    Destination: 00:00:1c:58:19:8a (00:00:1c:58:19:8a)
    Source: 00:05:5d:e6:0f:99 (00:05:5d:e6:0f:99)
    Length: 9
    Trailer: 00000000000000000000000000000000...
Logical-Link Control
    DSAP: Unknown (0x54)
    IG Bit: Individual
    SSAP: Unknown (0x14)
    CR Bit: Command
    Control field: U, func = UI (0x03)
        000. 00.. = Unnumbered Information
        .... ..11 = Unnumbered frame
ISO 8473 CLNP ConnectionLess Network Protocol
    Inactive subset
ISO 8073 COTP Connection-Oriented Transport Protocol
    Length indicator: 4
    TPDU code: 0x6 (AK)
    Credit: 2
    Destination reference: 0x1204
    Your TPDU number: 0x03

Frame 2 (60 bytes on wire, 60 bytes captured)
    Arrival Time: May 23, 2003 19:07:27.886983000
    Time delta from previous packet: 7.960673000 seconds
    Time relative to first packet: 7.960673000 seconds
    Frame Number: 2
    Packet Length: 60 bytes
    Capture Length: 60 bytes
    File Offset: 116 (0x74)
IEEE 802.3 Ethernet 
    Destination: 00:05:5d:e6:0f:99 (00:05:5d:e6:0f:99)
    Source: 00:00:1c:58:19:8a (00:00:1c:58:19:8a)
    Length: 24
    Trailer: 0200531B6162636465666768696A6B6C...
Logical-Link Control
    DSAP: Unknown (0x14)
    IG Bit: Individual
    SSAP: Unknown (0x54)
    CR Bit: Command
    Control field: U, func = UI (0x03)
        000. 00.. = Unnumbered Information
        .... ..11 = Unnumbered frame
ISO 8473 CLNP ConnectionLess Network Protocol
    Inactive subset
ISO 8073 COTP Connection-Oriented Transport Protocol
    Length indicator: 4
    TPDU code: 0x6 (AK)
    Credit: 1
    Destination reference: 0x0024
    Your TPDU number: 0x03
ISO 8073 COTP Connection-Oriented Transport Protocol
    Length indicator: 4
    TPDU code: 0x6 (AK)
    Credit: 1
    Destination reference: 0x0023
    Your TPDU number: 0x00
ISO 8073 COTP Connection-Oriented Transport Protocol
    Length indicator: 4
    TPDU code: 0x6 (AK)
    Credit: 1
    Destination reference: 0x0021
    Your TPDU number: 0x00
ISO 8073 COTP Connection-Oriented Transport Protocol
    Length indicator: 4
    TPDU code: 0x6 (AK)
    Credit: 1
    Destination reference: 0x0020
    Your TPDU number: 0x00