On 27/06/13 06:29, Michael Ossmann wrote:

I've had some people request that I submit the P25 CAI Wireshark
dissector upstream for inclusion in Wireshark. It makes sense to me
since it is quite stable. Do others agree?

If they'll accept it then that would be fantastic.

My only concern is that we currently use an unassigned UDP port and
encapsulate P25 CAI in UDP. Should we try to get an official pcap data
link type (DLT) instead? Are there reasons to prefer UDP over our own
DLT? If so, should we pursue standardizing a UDP port number?

We have an official IANA registered UDP port (port 6082) but we're not using it yet. Iits a trivial change to make that the port we monitor but it does requires some small dissector changes since we're now P25-in-UDP and we'll need to decide on one or two more details before its just so. Its an alternative to registering a P25 DLT.

If we want to encapsulate P25-in-UDP then we might want to add some metadata to the packet (capture frequency, signal strength). I did a quick hack around with a radiotap-like header but radiotap as a format sucks and simple tag-length-value would be easier.
ATB

Stevie