Wireshark mailing list archives

Adding IEEE 802.15.4 DLT for meta data?


From: James Ko <jim.list () hotmail com>
Date: Mon, 7 Jan 2019 21:18:20 +0000

I've been looking at how to add additional meta data information to IEEE 802.15.4 packets which are not part of the 
packet itself but may be part of the capture interface or required to aid in decrypting packets.

There are ongoing proposal in pcapng format for adding generic wireless meta data options to the enhanced packet block 
(EPB) and invariant (or seldom changing) capture interface meta data to a new capture interface block (CIB).
https://github.com/pcapng/pcapng/pull/51 and  https://github.com/pcapng/pcapng/pull/56

I see  that 802.11 has several DLT types for including metadata.  (DLT_PRISM_HEADER, DLT_IEEE802_11_RADIO, & 
DLT_IEEE802_11_RADIO_AVS)

I would like to propose one or more DLT types for including 802.15.4 meta-data.  Defining a new DLT type instead of 
relying on PCAPNG out of band data enables adding the additional information to pcap sources as well.
Preference of course is to have only one DLT type with type/length/value (TLV) for each meta data object just as pcapng 
deals with options.  However creating different DLT types may make more sense for the various MACs defined in 
IEEE802.15.4 (i.e. TSCH-MAC specific).  The new DLT would encapsulate the existing packet-ieee802154.c dissector as the 
last option.

A hybrid approach of using PCAPNG option blocks and DLT is not ruled out.

Any advice/comments on how to proceed or not proceed?  Shall I go just ahead and create the dissector with a new DLT 
type and submit it for code-review to solicit feedback?  Is the 802.11 approach of including meta data suitable?

Regards,
James

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread: