Re: [Ethereal-users] Ethereal on W2K POS/ATM Captures (alternatively on Linux)

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Nov 05, 2002 at 05:10:15AM -0500, mrmartin1903@xxxxxxxxxxxx wrote:
> For ATM there only seem to be options for RFC1483 and RFC1577
> available.

That's really one option - that's DLT_ATM_RFC1483, with a "-l" value of
100.

> I will have to find out if that is enough.  If you know of
> any more options for ATM encapsulations please let me know.

The other option is DLT_SUNATM, with a "-l" value of 123, supported by
recent versions of Ethereal.  In that encapsulation, the packet data
includes:

	a 4-byte ATM pseudo-header;

	an ATM AAL5/Signalling AAL PDU.

The pseudo-header is 4 bytes long, and contains, in order:

	a 1-byte flag byte;

	a 1-byte VPI value;

	a 2-byte *big-endian* (network byte order) VCI value.

The uppermost bit of the flag byte (i.e., the 0x80 bit) is 1 if the
packet was sent to the DCE (switch, etc.) and 0 if the packet was
received from the DCE.

The lower 4 bits of the flag byte indicate the type of traffic; the
traffic type values Ethereal can handle are:

	1		ATM LANE - the PDU is a LANE packet, beginning
			with the 2-byte LE Client/marker value, followed
			by the LE Control packet or encapsulated
			Ethernet packet

	2		RFC 1483 LLC-multiplexed traffic - the PDU
			begins with an 802.2 LLC header

	5		ILMI - the PDU is an SNMP PDU for ILMI

	6		Q.2931 - the PDU is a Q.2931 message, beginning
			with the protocol discriminator for Q.2931, and
			with the SSCOP trailer at the end