Wireshark-bugs: [Wireshark-bugs] [Bug 8522] Add heuristic to dissect DVB-S2 over ethernet

Date: Mon, 27 May 2013 08:14:49 +0000

changed bug 8522

What Removed Added
Status INCOMPLETE RESOLVED
Resolution --- NOTABUG

Comment # 12 on bug 8522 from
Evan, Guy,

Thanks for your answers and sorry for the (long) delay.

(In reply to comment #10)
> So in what circumstances is this encapsulation used?
> 
> Is it on an Ethernet on which other protocols are running, where you're
> actually sending the frames from one machine to one or more hosts to process
> ("more hosts", in the case of the test capture, as it's being sent to the
> broadcast address), or is this a hack similar to Cisco's
> DOCSIS-over-Ethernet hack, where the lowest-level Ethernet framing is being
> used, but the actual contents of the frame is a DOCSIS frame and there's no
> Ethernet header on the frame?  (It's "DOCSIS-over-Ethernet" to support
> sniffing DOCSIS traffic without requiring special hardware on your sniffer,
> not "DOCSIS-over-Ethernet" to support transporting DOCSIS packets over an
> Ethernet for communications purposes.)

Its the later: a low-level ethernet framing is used but the content of the
frame is the SATLAB mode adaptation payload, in order to allow sniffing traffic
with a common equipment, kind like the DOCSIS-over-Ethernet you described.
Again, this is because the SATLAB specification did not define the low-level
layer to transport the DVB-S2 payload. It'd be great if they do so...

> 
> If the former, you appear to be using fields with a length field rather than
> a type field; if the DVB-S2 frame immediately follows the 14-byte Ethernet
> header, that's not a valid Ethernet frame, as an 802.2 header should follow
> an Ethernet header with a length field.

I understand very well that this format is not a valid ethernet frame, as a
matter of fact, we dropped this equipment to work with one using the already
implemented dissector, ie using UDP, easier to use. Thus, I think it is all
right to drop the patch and mark this request as resolved.

Thanks,
Audric


You are receiving this mail because:
  • You are watching all bug changes.