On Tue, Jul 22, 2003 at 10:49:54AM +0200, James Mastros wrote:
> The second, more major problem: I don't know how to get etheral to decode
> it as ISDN packets. If I try the niave way of doing it, as above, it tries
> to interpret them as ethernet, reasonably enough. Reading the manpage, the
> proper way to do it seems to be to give a -l parameter, with the proper
> link-layer type, as a BPF_* constant. Unfornatly, there doesn't seem to be
> one of those for ISDN.
No, there isn't one.
> I looked at wiretap/i4btrace.c, hoping I could see
> what it did and do likewise. It uses wth->file_encap = WTAP_ENCAP_ISDN;,
> IE 17, but that doesn't work -- apparently, WTAP_ENCAP_s aren't the same as
> BPF_* protocols;
Correct. Ethereal can read capture files other than libpcap files, so
it needs to support more encapsulation types than are currently
supported in libpcap. One such encapsulation type is ISDN.
> BTW, the data seems to be at the LPAD level, meaning, if I read packet-
> isdn.c:dissect_isdn correctly, I may need to prepend some sort of psudo-
> header anyway.
Yes, you would - you'd have to supply an ISDN channel number for every
packet. (A direction, i.e. network-to-user or user-to-network, would
also be useful, but if that information isn't available, labeling all
packets as N2U or U2N might work well enough for your purposes.)