On Apr 28, 2013, at 12:13 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
> On Apr 28, 2013, at 8:32 AM, Evan Huus <eapache@xxxxxxxxx> wrote:
>
>> ... (this will likely involve adding a new linktype to the official list [2]).
>>
>> Once that is done we can add a dissector to Wireshark for the framing
>> protocol,
>
> ...both of which will be necessary only if they do something different from the "add a fake Ethernet header with special Ethertypes for PPP packets" hack that they've done in the past for PPP; we already dissect that.
The spec given appears to talk only about low-level USB stuff, not about how it plugs into the networking stack, so the W8 changes probably would not require any changes in WinPcap.
The document on Windows *7* changes to mobile broadband:
http://msdn.microsoft.com/en-us/library/windows/hardware/gg454521.aspx
*does* indicate that there's a new NDIS medium type, NdisMediumWirelessWan, and that the packets show up as raw IP frames. There's already a link-layer type for raw IP, DLT_RAW, and we already have a dissector for it, so the only change needed to WinPcap would be:
support for mapping NdisMediumWirelessWan to DLT_RAW;
doing whatever's necessary to be able to see those devices in the first place;
and the latter is probably the biggest part. I don't know whether the WinPcap NDIS driver would have to plug into the networking stack in a different fashion in order to make that work; it might have to. That would be a very significant change.