diff options
| author | Jörg Mayer <jmayer@loplof.de> | 2010-09-24 18:12:45 +0000 |
|---|---|---|
| committer | Jörg Mayer <jmayer@loplof.de> | 2010-09-24 18:12:45 +0000 |
| commit | c749fe000ce2452865ef09c1677b2d60e47a39aa (patch) | |
| tree | 79f55ac8f0ebeeee2c1fe9555736cf7a3ad5b227 /epan/dissectors/packet-cisco-erspan.c | |
| parent | f442f4fe49d7b7478ac992d0791b911bc446cd92 (diff) | |
Comparing type II and III traces of the same packet
indicate that the last 4 bytes of both types are similar.
So the extra bytes in type III are inserted before those
last bytes.
svn path=/trunk/; revision=34238
Diffstat (limited to 'epan/dissectors/packet-cisco-erspan.c')
| -rw-r--r-- | epan/dissectors/packet-cisco-erspan.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/epan/dissectors/packet-cisco-erspan.c b/epan/dissectors/packet-cisco-erspan.c index f5e1c283e7..a71c1cc0fc 100644 --- a/epan/dissectors/packet-cisco-erspan.c +++ b/epan/dissectors/packet-cisco-erspan.c @@ -82,6 +82,7 @@ static int hf_erspan_unknown4 = -1; static int hf_erspan_direction2 = -1; static int hf_erspan_unknown5 = -1; static int hf_erspan_unknown6 = -1; +static int hf_erspan_unknown7 = -1; #define PROTO_SHORT_NAME "ERSPAN" #define PROTO_LONG_NAME "Encapsulated Remote Switch Packet ANalysis" @@ -161,11 +162,7 @@ dissect_erspan(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) FALSE); offset += 2; - if (version == 1) { - proto_tree_add_item(erspan_tree, hf_erspan_unknown4, tvb, - offset, 4, FALSE); - offset += 4; - } else { /* version = 2 */ + if (version == 2) { proto_tree_add_item(erspan_tree, hf_erspan_timestamp, tvb, offset, 4, FALSE); offset += 4; @@ -181,9 +178,12 @@ dissect_erspan(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) offset += 2; proto_tree_add_item(erspan_tree, hf_erspan_unknown6, tvb, - offset, 8, FALSE); - offset += 8; + offset, 4, FALSE); + offset += 4; } + proto_tree_add_item(erspan_tree, hf_erspan_unknown7, tvb, offset, 4, + FALSE); + offset += 4; } else { offset += 8; @@ -252,6 +252,10 @@ proto_register_erspan(void) { "Unknown6", "erspan.unknown6", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_erspan_unknown7, + { "Unknown7", "erspan.unknown7", FT_BYTES, BASE_NONE, NULL, + 0, NULL, HFILL }}, + }; static gint *ett[] = { &ett_erspan, |