[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Mar 22, 2004 at 02:07:49PM -0600, clay wispell wrote:
> mgsl0     Link encap:(Cisco)-HDLC

Well, if you're capturing on msgl0, that would certainly explain why
Ethereal thinks it's Cisco HDLC! The driver is probably telling libpcap
that it's Cisco HDLC (ARPHRD_CISCO), and libpcap is mapping that to
DLT_C_HDLC (as it should), and Ethereal's interpreting that as Cisco
HDLC (as it should).

There is no ISDN format in libpcap, so you can't arrange to capture on
an interface and have the data interpreted as ISDN.  You'd have to write
your own program to read the packets and write them out in some format
that Ethereal *will* interpret as ISDN - for example, i4btrace format
(see wiretap/i4btrace.c, wiretap/i4btrace.h, and wiretap/i4b_trace.h).

> i have tried various dissector_add in packet-chdlc.c with no luck:
> 
> dissector_add("wtap_encap", WTAP_ENCAP_ISDN, chdlc_handle);

That would have exactly the *opposite* effect from what you want - it'd
cause ISDN packets to be dissected by the Cisco HDLC dissector.