[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 1 on bug 11220 from Guy Harris

(In reply to Evgeniy from comment #0)
> Created attachment 13628 [details]
> I tried to decode dump with PCLI, but it looks like there are some changes
> in PCLI header (cisco include some additional information 24 bytes).
> 
> please check attach.
> 
> btw i didn't found any information about changing of header...

Take a look at the CableLabs specifications; there are a whole bunch of
different specs with different headers for Call Content Connection packets. 
The current dissector dissects a header from

   
http://web.archive.org/web/20030428211154/http://www.packetcable.com/downloads/specs/pkt-sp-esp-I01-991229.pdf

which has only a 4-byte Call Content Connection (CCC) Identifier in the header.
 However,

   
http://www.cablelabs.com/wp-content/uploads/specdocs/PKT-SP-ESP1.5-I02-070412.pdf

gives the CCC Identifier followed by an 8-byte NTP timestamp as the header, and

   
http://www.cablelabs.com/wp-content/uploads/specdocs/PKT-SP-ES-DCI-C01-140314.pdf

adds an 8-octet Case ID after the NTP timestamp.

In your capture, it looks as if there might be a 12-octet header followed by an
*Ethernet* packet, rather than an *IP* packet.  Perhaps there's some other
CableLabs spec that Cisco is following, or perhaps they're using some
non-CableLabs spec.

---

      You are receiving this mail because:

• You are watching all bug changes.