Guy Harris wrote:
>On Tue, May 27, 2003 at 06:18:48PM +0100, Martin Regner wrote:
>> NAI Sniffer:
>> ----------------
>> The packets were decoded as ISO-TP (i.e. COTP) over CLNP (Null).
>> There was no specific indication what SAP 0x14 or 0x54 meant.
>>
>> Wandel & Goltermann Examine:
>> --------------------------------------------
>> The packets were decoded as ISO-TP (i.e. COTP) over CLNP (Null).
>> SAP 0x14 was indicated as "0x14 (ISO)"
>> SAP 0x54 was indicated as "0x54 (ISO)"
>
>I.e., both Sniffer and W&G's Examine treat both 0x14 and 0x54 as SAPs
>for CLNP-over-802.2?
>
>That suggests that they're at least semi-standard, and that Ethereal
>should also treat them as such.
I made some more tests yesterday with the capture file I had modified with text2pcap to test different combinations
of SAP values.
Both NAI Sniffer and W&G Examine handled the LL SAP values 0x14, 0x20, 0x34 and 0x54 as SAPs for CLNP-over-802.2.
For most other values SAP values that I tested (I only tested the range 0x00 to 0x7E yesterday) I got "Unknown SAP value"
in NAI Sniffer.
0x42 was decoded as BPDU, 0x04 UI SNA Frame, 0x06 as IP, 0x08 SNA, 0x10 IPX etc
W&G Examine gave the following results:
0x00 (NONE)
0x01 (NONE) (group)
0x02 (Unknown)
0x04 (SNA)
0x05 (SNA) (Group)
0x06 (IP)
0x07 (IP) (Group)
0x08 (SNA)
0x09 (SNA) (Group)
0x0A (Unknown)
0x0B (Unknown) (Group)
0x0C (SNA)
0x0D (SNA) (Group)
0x0F (Unknown) (Group)
0x10 (IPX)
0x11 (IPX) (Group)
0x12 (Unknown)
0x13 (Unknown) (Group)
0x14 (ISO)
0x15 (ISO) (Group)
0x16 (Unknown)
:
0x20 (ISO)
0x21 (ISO) (Group)
:
0x34 (ISO)
0x35 (ISO) (Group)
:
0x42 (BPDU)
:
0x54 (ISO)
I forgot to test the value 0xEC, that was listed as CLNP (ISO) in http://datacenter.packx.free.fr/Identifiers/ieee-saps.txt
I think it should be OK to add 0x14, 0x20, 0x34 and 0x54 in llcsaps.h and then register
those llc.dsap values in packet-osi.c. However I cannot prepare a patch for it right now.