https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3453
--- Comment #3 from Nathan Hartwell <nhartwell@xxxxxxxxx> 2009-05-07 23:49:12 PDT ---
I can see where you are coming from with that response. It is a bit inelegant
to check if all LLC frames are HP teaming frames. However, I do feel that it
does belong in the LLC dissector for a few reasons:
-If you check the HP teaming white paper I referenced the heartbeat frames
really are just LLC frames with 63 bytes of data.
-I felt the destination MAC was the deciding factor since the packet already
was getting dissected by the LLC dissector. If the packet is found to be a snap
frame AND has the well known HP teaming MAC as the destination then there is a
good chance it is going to be a teaming heartbeat....or one malformed packet
:).
Essentially I felt as though I could add an exception within packet-llc, or
write a whole new dissector which would boil down to being the same code as the
LLC dissector. Now the packets will be labeled as teaming heartbeats within the
Wireshark display as compared to the generic unknown LLC / SNAP based packet
that it was getting listed as before (with the data size off by 5 bytes).
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.