Ethereal-users: Re: [Ethereal-users] Questions about Ethereal 0.9.15

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 9 Oct 2003 12:16:35 -0700

On Oct 8, 2003, at 12:06 PM, ms 1530 wrote:

In the new Ethereal 0.9.15 release, it seems support New protocols GPRS BSSGP, GPRS NS. But I just wonder how I can capture these message,

GPRS NS runs atop Frame Relay, so you'd have to capture Frame Relay traffic - whether it's raw Frame Relay, or Frame Relay tunneled over, for example, GRE.

You'd also have to set the encapsulation preference for the Frame Relay dissector in order to have it dissect the Frame Relay traffic in question as GPRS NS traffic. Select "Preferences" from the "Edit" menu, open up the "Protocols" list, select "FR", and choose "GPRS Network Service" as the encapsulation. Then click "OK" if you want it to apply to captures in the current Ethereal session, or "Save" and then "OK" if you want to make that your default setting for all captures.

 which kind of device ethereal supports?

The set of devices on which Ethereal can capture depends mainly on the OS on which you're running, and the version of libpcap/WinPcap on that OS. See

	http://www.ethereal.com/media.html

That list doesn't include raw Frame Relay, however; we should probably update that. I suspect the answers are "No" for most platforms, and "Unknown" for {Free,Net,Open}BSD, as there's code in the most recent release of libpcap to support it, but I don't know whether anybody's ever tested it. The current CVS version of libpcap should also support Frame Relay on Linux, as somebody recently contributed a patch to support it.

Note, however, that this captures traffic going to or from the machine running Ethereal; libpcap doesn't support any devices that support passive capture on Frame Relay (although the current CVS version of libpcap does work with the Endace DAG hardware:

	http://www.endace.com

for passive capture, but they don't support Frame Relay, just ATM and Ethernet).