Subject: Re: [tcpdump-workers] Re: 802.11 libpcap support
To: Michael Richardson <mcr@sandelman.ottawa.on.ca>
From: Guy Harris <guy@netapp.com>
List: tech-net
Date: 05/22/2002 14:21:39
On Wed, May 22, 2002 at 03:30:11PM -0400, Michael Richardson wrote:
>   1) GigE, which has to do 802.3 and not EthernetII if you want jumbo frames.

I.e., if you're doing jumbo frames, it sends 802.3 frames with a length
field greater than 1500, so that the usual "if it's >1500, it's an
Ethertype, and if it's <= 1500, it's a length field" check has to be
turned off for jumbo frame GigE?

If so, the answer there might be to add a DLT_IEEE802_3 type, which is
returned by Ethernet devices running in a mode where there are 802.3
packets with a length field > 1500, and have tcpdump, Ethereal, etc.
always dissect those frames as 802.3 frames, rather than doing the
type/length field check.

>   2) CiscoHDLC type stuff.

Which Cisco HDLC stuff?  There's a DLT_ type for Cisco HDLC -
DLT_C_HDLC; interfaces that can run, for example, PPP or CHDLC should
return DLT_PPP if they're running PPP and DLT_C_HDLC if they're running
Cisco HDLC.  (If they're running both on the *same* line, you'd have to
return DLT_PPP and have the program look at the header to determine
whether it's:

	PPP-with-HDLC-framing, starting with 0xff 0x03;

	Cisco HDLC, starting with 0x0f or 0x8f;

	PPP-without-HDLC-framing, starting with anything else.

>   3) Ethernet over ATM types.

Is that the bridged Ethernet over ATM stuff?