On Fri, Oct 10, 2003 at 12:48:37PM -0600, Vikas Sarawat wrote:
> I want to decode DOCSIS1.1 packets in ethereal. I was able to open the
> SIGTEK( DOCSIS RF tracing tool) captured file in ethereal, but ethereal
> could not decode the packets to show the details.
>
> I was wondering if any one on the list uses ethereal for his purpose or
> knows how to make it decode DOCSIS1.1?
If they are the company I remember seeing mentioned elsewhere, their
analyzers can save files in libpcap format, so that's presumably what
you're reading.
There's no DLT_DOCSIS (because the DOCSIS support in Ethereal was
originally put in for use with a Cisco cable modem device that puts
DOCSIS packets out as bogus Ethernet packets, using an Ethernet as a raw
bit pipe, so the captures look to libpcap like Ethernet captures as
you're capturing on an Ethernet), so there's no way to distingish DOCSIS
captures from Ethernet captures based purely on the file contents.
Therefore, there's a preference setting for the top-level dissector, the
"Frame" dissector; select "Preferences" from the "Edit" menu, open up
the "Protocols" list, select "Frame", turn on the "Treat all frames as
DOCSIS frames" option, and click "OK" (click "Save" first if you want
that to be the default).
I think I either sent mail to somebody at Filtronic-Sigtek saying they
should write code to directly read their captures in Ethereal (and send
it to us so we can put it into the official release), as that'd avoid
the need for them to save in libpcap format *and* avoid the need to tell
Ethereal to treat all frames as DOCSIS frames, or gave them that
feedback in some other way. I never heard back from them.
If you can send us a SIGTEK file in their native file format, we can use
it to develop and test code that reads it (the manual for the ST260B
documents the file format).