[clay wispell <clay.wispell@xxxxxxxxxxxxxxx>]

hi guy,

thanks for your help. i think i have enough to keep busy for a while.

clay



Guy Harris wrote:
> On Mon, Mar 22, 2004 at 02:07:49PM -0600, clay wispell wrote:
>
> > mgsl0     Link encap:(Cisco)-HDLC
>
>
> Well, if you're capturing on msgl0, that would certainly explain why
> Ethereal thinks it's Cisco HDLC! The driver is probably telling libpcap
> that it's Cisco HDLC (ARPHRD_CISCO), and libpcap is mapping that to
> DLT_C_HDLC (as it should), and Ethereal's interpreting that as Cisco
> HDLC (as it should).
>
> There is no ISDN format in libpcap, so you can't arrange to capture on
> an interface and have the data interpreted as ISDN.  You'd have to write
> your own program to read the packets and write them out in some format
> that Ethereal *will* interpret as ISDN - for example, i4btrace format
> (see wiretap/i4btrace.c, wiretap/i4btrace.h, and wiretap/i4b_trace.h).
>
>
> > i have tried various dissector_add in packet-chdlc.c with no luck:
> >
> > dissector_add("wtap_encap", WTAP_ENCAP_ISDN, chdlc_handle);
>
>
> That would have exactly the *opposite* effect from what you want - it'd
> cause ISDN packets to be dissected by the Cisco HDLC dissector.
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users