Wireshark-bugs: [Wireshark-bugs] [Bug 9427] Dissector for T1-data-over-TCP protocol from Guisys

Date: Wed, 13 Nov 2013 23:37:54 +0000

Comment # 7 on bug 9427 from
(In reply to comment #6)
> OK, so is this running directly over Ethernet/802.3, so that the first byte
> after the 14-byte Ethernet header is the first byte of the payload, or over
> 802.2, so that, after the 14-byte Ethernet header, there's a 3-byte or
> 4-byte 802.2 LLC header?

Guy, 

I'm going to say yes, but qualified with my lack of reading hex, but backed up
by Guisys's statement: "The continuous/sequential Frame-Relay data resides at
0010 through 0C18 of each and every Ethernet Frame."

The end may be further, since they later said: "...it should be, "0010 through
03CF" not "0100 through 03CF".

I would say that in the data of the Guisys output, the first information is
layer 2 data for a normal Ethernet packet, subject to the following in their
documentation to me.

Ethernet Frame Structure [Brett: not the payload of Test3 trace frames]
• Each complete T1-Bridged Ethernet Frame consists of 984 bytes (including the
4-byte FCS)
• See Figure 2 (Below) Screen shot of Wireshark
• The structure is as follows; 6+6+2+2+960+4+4 = 984
1. Destination MAC address (6-bytes) - in this example; ff ff ff ff ff ff
2. Source MAC address (6-bytes) - in this example; 00 00 25 af 00 00 Ramtec mfg
3. Packet Length (2-bytes) - for T1-payload this will always be; 03 c6
4. A Packet Sequence Number (2-bytes) - in this case; 00 00 (but will increment
each
Frame)

The T1 content
1. Only T1 payload or content is transferred to the Ethernet Frame (no T1
Framing
or Overhead)
2. The Packets always start with DS0 Channel-1 (unless the T1 slips due to
incorrect clocking)
3. and continues through to DS0 channel-24
4. The Packet contains a total of 40-T1's (960-bytes). Starting at 0010 and
ending
at 03CF.
6. A GUISYS calculated CRC, used ensure payload integrity (4-bytes) - in this
example; 8d
ae 0c 18 (note that this is not the Ethernet Frame FCS)
• The Content of Interest (your Bridged Frame-Relay data);
1. Runs from 0010 and ends at 03CF
2. Continues with each subsequent Ethernet Packet at these same locations.

<cut>

Hope this helps - Brett


You are receiving this mail because:
  • You are watching all bug changes.