marc hermstein said:
> I have raw LLC-PDU's from the air link (Um) side.
In what type of file are those stored? Or by "I have" do you mean you
have code to capture them from the air link side, but don't have them in a
file?
If it's a type of file that Ethereal doesn't yet read (from, for example,
some vendor of mobile phone testing and monitoring equipment), modifying
Ethereal's Wiretap library to be able to read it, complete with a Wiretap
link-layer encapsulation type for LLC, and having the GPRS LLC dissector
register in the "wtap_encap" dissector table with that encapsulation type,
would be sufficient.
If it's a type of file that Ethereal *does* read, then presumably you've
added a new link-layer type for GPRS LLC, in which case you should add new
new Wiretap link-layer encapsulation type, modify the Wiretap code that
reads that file type to handle the new link-layer type, and have the GPRS
LLC dissector register in the "wtap_encap" dissector table.
If you don't have them in a file, you might want either to invent a new
capture file format and make Ethereal read it, or use libpcap format, in
which case you should ask tcpdump-workers@xxxxxxxxxxx for a DLT_ value for
GPRS LLC and, once you've gotten that, use that and do the "if it's a type
of file that Ethereal *does* read" work.