I try to analyze ISDN data which contain SAPI 16 packet data, which is X.31. X.31 data is X.25 packet data (layer 3). So far I know, wireshark can decode X.25, but if I select the data field, I cannot decode it since Decode as is not available (grayed out). The layer 2 LAPD data is displayed correctly, the address field SAPI is also correctly displayed as "X.25 Level 3 procedures (16)", but the content of the I field is not decoded. Does it be possible to tell wireshark somehow, that a I field on a LAPD frame with SAPI 16 has X.25 content ?
asked 19 Jul '12, 02:33
It seems that the X.25 dissector doesn't register itself with the LAPD dissector for this SAPI. I'm not sure why. You could/should register a bug for this at bugs.wireshark.org, attaching a sample capture file showing this, so it can be addressed.
answered 19 Jul '12, 04:59