<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 27/06/13 06:29, Michael Ossmann wrote:
<blockquote cite="mid:20130626202922.GG15671@ossmann.com"
type="cite">
<span style="display:none"> </span><!--
~-|**|PrettyHtmlStartT|**|-~-->
<div id="ygrp-mlmsg" style="position: relative;">
<div id="ygrp-msg" style="z-index: 1;">
<div id="ygrp-text">
<p>I've had some people request that I submit the P25 CAI
Wireshark<br>
dissector upstream for inclusion in Wireshark. It makes
sense to me<br>
since it is quite stable. Do others agree?<br>
</p>
</div>
</div>
</div>
</blockquote>
<br>
If they'll accept it then that would be fantastic.<br>
<br>
<blockquote cite="mid:20130626202922.GG15671@ossmann.com"
type="cite">
<div id="ygrp-mlmsg" style="position:relative;">
<div id="ygrp-msg" style="z-index: 1;">
<div id="ygrp-text">
<p>
My only concern is that we currently use an unassigned UDP
port and<br>
encapsulate P25 CAI in UDP. Should we try to get an
official pcap data<br>
link type (DLT) instead? Are there reasons to prefer UDP
over our own<br>
DLT? If so, should we pursue standardizing a UDP port
number?<br>
</p>
</div>
</div>
</div>
</blockquote>
<br>
We have an official IANA registered UDP port (port 6082) but we're
not using it yet. Iits a trivial change to make that the port we
monitor but it does requires some small dissector changes since
we're now P25-in-UDP and we'll need to decide on one or two more
details before its just so. Its an alternative to registering a P25
DLT.<br>
<br>
If we want to encapsulate P25-in-UDP then we might want to add some
metadata to the packet (capture frequency, signal strength). I did a
quick hack around with a radiotap-like header but radiotap as a
format sucks and simple tag-length-value would be easier.<br>
ATB<br>
<br>
Stevie<br>
</body>
</html>