I try to analyze ISDN data which contain SAPI 16 packet data, which is X.31. X.31 data is X.25 packet data (layer 3). So far I know, wireshark can decode X.25, but if I select the data field, I cannot decode it since Decode as is not available (grayed out). The layer 2 LAPD data is displayed correctly, the address field SAPI is also correctly displayed as "X.25 Level 3 procedures (16)", but the content of the I field is not decoded. Does it be possible to tell wireshark somehow, that a I field on a LAPD frame with SAPI 16 has X.25 content ? asked 19 Jul '12, 02:33  pingus |
One Answer:
It seems that the X.25 dissector doesn't register itself with the LAPD dissector for this SAPI. I'm not sure why. You could/should register a bug for this at bugs.wireshark.org, attaching a sample capture file showing this, so it can be addressed. answered 19 Jul '12, 04:59  Jaap ♦ |
Thanks for the hint, I did this and I also added a quick patch I did to decode the LAPD X31 traffic as X.25. It would better if somebody with more knowledge about wiresharks internals to add X.31 as variant of X.25, but with the patch it works for me well enough.
For reference the bug is 7514.