Re: [ethereal-dev] LAPB/X.25 patch

[Guy Harris <guy@xxxxxxxxxx>]

> Perhaps, but if my memory is not too bad, I think I had to configure the
> modulo value for my network before capturing with a radcom analyser, so
> I suppose it can't be guessed.

Perhaps, if an SABME frame must be in the capture file, you have to
configure it in the analyzer to handle the case where you *don't*
capture the SABME frame.

Can the RADCOM analyzer read a capture file it's saved?  If so, do you
have to configure the modulo value even if you're reading a saved
capture?

> Anyway, if you're right, the SABME frame must be in the capture file or
> you won't be able to detect whether extended LAPB is used.

Yup - there are places in various protocols where, in order to dissect a
frame, you need to see at least one of the frames that preceded it.

> I have a sniffer that handles X.25, and the manual says nothing about
> it.

Oh, well.  It doesn't have *any* section in the manual about the capture
file format?