On Wed, Jun 30, 2004 at 04:56:09PM -0700, Barrinuevo, George wrote:
> Does Ethereal support AAL5 encapsulation which has many formats?
Yes.
That doesn't mean it supports *all* the types of traffic that can be
sent over AAL5, however...
> I have
> found it supports 802.3 Ethernet encapsulations, but could not get it to
> read 802.4/5 (token ring/bus).
...and it doesn't mean it can necessarily *recognize* all those types.
In particular:
in libpcap or snoop SunATM captures, Endace ERF captures, and
probably AIX iptrace captures, there's no indication of whether
LANE traffic is Ethernet or Token Ring LANE, so it assumes it's
Ethernet;
in Windows Sniffer captures, we havne't yet found anything in
the per-packet record header to indicate whether LANE traffic is
Ethernet or Token Ring, so it assumes it's Ethernet;
we haven't even *seen* any Microsoft Network Monitor captures,
we've just discovered that a particular link-layer type in the
file header convinces NetMon that the traffic is ATM, and we
haven't done a lot more experimentation, so we don't know
whether there's anything that indicates whether LANE traffic is
Ethernet or Token Ring traffic.
What tool did you use to capture that traffic?
> Ethereal can read the LLC part, but cannot decode the MAC frame after
> the LLC.
So is it recognizing the traffic as Token Ring, or is it mis-dissecting
it as Ethernet?
If it's recognizing it as Token Ring, what do you mean by "cannot decode
the MAC frame after the LLC"? What follows an 802.2 header depends on
the DSAP and SSAP of in the LLC header, so perhaps Ethereal just doesn't
recognize the DSAP and SSAP (or, if they're 0xAA, doesn't recognize the
Ethernet type, if the SNAP OUI is 0, or doesn't recognize the OUI and
protocol ID).