How to dissect a VLAN frame based on Ethertype
Hi,
I'm trying to write a new dissector for an in-house protocol. This protocol is completely L2, there is no IP header. The frame will be dissected using a specific vlan.id, but I cannot find a way to do so... The following doesn't seem to be working:
dissector_add_uint("vlan.id", xxx_vlan, xxx_handle);
Do i need to use another library than epan/packet.h??
Does your protocol have a unique ethertype value, or is it just re-using one already assigned for another purpose? The Ethertype table is here.
it's just 0x8100, 802.1Q type
That's not the Ethertype value for your protocol, it's the value that's put in the last 2 octets of the Ethernet header to indicate that this is an 802.1Q-tagged frame. At least according to 802.1Q, that value is the TPID of the tag header; what follows it is the 2-octet TCI field, which is the second part of the tag header.
So, for those frames, what follows the VLAN tag header? Is it a 2-octet Ethertype field, as 802.1Q seems to indicate that it should be on Ethernet, or is it something else?
Yeap, you're right, sorry I always mix up these two. The ethertype is 0xa003. To be honest, I could also use ethertype instead of vlan.id to call the dissect. I tried that also but I had the same result...
I.e. all of your packets have in them, starting with the destination MAC address at the beginning: