["Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>]

From: "Ronnie Sahlberg"
Sent: Friday, October 03, 2003 8:28 PM
Subject: Re: [Ethereal-users] Does Ethereal support the 'real' ARCNet?


> Ethereal has a decoder that dissects the frame format that is described
in:
> http://www.zvon.org/tmRFC/RFC1201/Output/chapter2.html
>
> I.e. the Data Packets of ARCNet.
> Ethereal does not have a decoder for ACK, NACK,EOT or ENQ "packets".
>
> Since ACK, NACK packets are 1 byte in size
> and EOT and ENQ packets are 3 bytes in size it would be trivial to add
> decoding of these packets to
> ethereal,  IF capture files containing such "packets" are available to
test
> with.

And IF a new type of pcap frame type is added that can describe the low
level frame
format of ARCNet packets.
(A quick glance suggests that the current pcap only has a frame definition
for ARCNet data packets
where the StartOfHeader byte has been stripped.
)

In order to support ACK, NACK, EOT and ENQ frames you will have to create a
new
frame format for PCAP so that the capture file can describe these types of
frames.

After this you would need to poke the Linux and BSD ARCNet developers to
provide a new
API to gain access to these uncooked frames instead of as now where the
existing APIs only provide
the Data frames after the SOF has been stripped (and the frame has been
slightly mangled)

After this it will be trivial to add decode functionality of these frames to
ethereal.