Re: [ethereal-dev] LAPB/X.25 patch

[Olivier Abad <oabad@xxxxxxxxxxxxx>]

On lun, aoû 02, 1999 at 03:13:40 -0700, Guy Harris wrote:
> > Apparently, the fields of the LAPB frame aren't sufficient to
> > determine if it is extended LAPB or not (i.e. modulo 128 or modulo
> > 8). I guess this information is stored in the data file by the
> > analysers but I don't know where.
> 
> Perhaps it's set by one of the Set Mumble Mumble Mode Extended
> commands? I.e., perhaps the connection starts off in basic mode, and
> one side sends something like Set Asynchronous Balanced Mode Extended
> to tell the other side that they should both run modulo 128?

Perhaps, but if my memory is not too bad, I think I had to configure the
modulo value for my network before capturing with a radcom analyser, so
I suppose it can't be guessed.

Anyway, if you're right, the SABME frame must be in the capture file or
you won't be able to detect whether extended LAPB is used.

> > Does somebody have documentation about ngsniffer data file format
> > (especially for X.25 : the documentation I have doesn't talk about
> > X.25) ?
> 
> Sniffer manuals tend to have that...
> 
> ...unfortunately, if you don't have a Sniffer that handles some
> particular networking type, the manual may not document that type.

I have a sniffer that handles X.25, and the manual says nothing about
it.

Olivier
-- 
You teach best what you most need to learn.