Wireshark-dev: [Wireshark-dev] Zigbee stack NCP dissector: new WTAP_ENCAP or extension to 802.1

From: Eugene Exarevsky <eugene.exarevsky@xxxxxxxxxxxxxxxxxxx>
Date: Tue, 26 Oct 2021 12:08:07 +0300
Hi all,

We are developing Zigbee protocol stack ZBOSS.
The stack has serial commands interface - NCP.
We implemented a dissector of that NCP protocol for Wireshark and want to publish it. The idea is that we can display NCP commands and Zigbee traffic between the stack and Zigbee transceiver in the same log.

Now NCP parser is implemented as a part of packet-ieee802154.c. I am not sure this is optimal solution. Indeed serial NCP protocol traffic is not 802.15.4 at all.
Can separate PCAP DLT/WTAP_ENCAP be better?
How complex is to allocate PCAP DLT number?
Or, maybe, it is ok to keep NCP dissector in packet-ieee802154.c?
--

Best Regards,
Eugene