Why there is no way to force wireshark to decode perfectly normal TP4 transport layer (it's called COTP in wireshark terms) packets inside CLNP network layer? All I see is "Data" and there is no way to "Decode as" or apply any other dissector. On wireshark wiki it states: "CLNP: COTP uses CLNP as its underlying network protocol." And yes, this is the case. Example (don't see how to attach actual pcap):
asked 19 Dec '11, 04:10 Constantine P edited 19 Dec '11, 04:14 |
One Answer:
OMG, thanks god we have source code:
And I this leads to option inside CLNP protocol preferences that says: "Always try to decode NSDU as transport PDUs" Check it and it works! I really wonder why it's not checked by default, people use CLNP for something else? answered 19 Dec '11, 07:20 Constantine P |
how did u manage to generate tp4 traffic , i can't find any application that uses this protocol , well ... i found atn linux implementation but i couldn't compile it , may i ask for your help on how to generate tp4 traffic ?