pcap: network type 285 unknown or unsupported - Unable to open Marvell DSA tagged pcap file

asked 2024-03-15 09:46:18 +0000

Mo
3 ●1

I try to read a tcpdump capture that contains DSA tagged traffic from a Marvell Switch.

When I try to open the file in Wireshark, I get:

The file "eth0_mwe.pcap" contains record data that Wireshark doesn't support.
(pcap: network type 285 unknown or unsupported)

Do Iassume correctly that Wireshark does not support netwrok type 285, as hinted by this answer?

Still, I'm interested:

Is there any plan for support? Didn't find anything in the Development/Roadmap section
Is there any cheap work around? For example, it seems to me that one could write a Lua dissector for this, but I only skimmed their docs.

Right now I'm just displaying the packets with tcpdump on the command line, so it's not really a critical issue for me.

answered 2024-03-16 00:14:23 +0000

Guy Harris
19890 ●3 ●634 ●207

Do Iassume correctly that Wireshark does not support netwrok type 285

Yes.

Is there any plan for support? Didn't find anything in the Development/Roadmap section

The roadmap is just a schedule; most new capabilities in Wireshark, including support for link-layer types, aren't planned, they just arrive if somebody decides to write code for them and submit a merge request.

edit flag offensive delete link

Comments

epan/dissectors/packet-pcap_pktdata.c has a table that maps number to text description:

    { 284,  "DSA_TAG_DSA" },
    { 285,  "DSA_TAG_EDSA" },

Could/should the description be included in the error message?

Chuckc ( 2024-03-16 02:03:23 +0000 )edit

Could/should the description be included in the error message?

Not all programs that use libpcap include dissectors; editcap, for example, doesn't.

Guy Harris ( 2024-03-16 02:13:37 +0000 )edit

Is this "according to Hoyle"? Could the table be moved from the .c to a .h?
editcap.c:

#include "epan/etypes.h"
#include "epan/dissectors/packet-ieee80211-radiotap-defs.h"

Chuckc ( 2024-03-16 02:34:06 +0000 )edit

Could the table be moved from the .c to a .h?

Or either to libwireshark or libwsutil.

Guy Harris ( 2024-03-16 06:40:51 +0000 )edit

Thanks for the answer. @Chuckc Good idea. One reason for this question was that others can find the cause of the error more quickly. But as I didn't find any other people wanting to know about this error, I'm not sure if it is worth the effort.

Mo ( 2024-03-16 09:17:02 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

pcap: network type 285 unknown or unsupported - Unable to open Marvell DSA tagged pcap file

1 Answer

Comments

Your Answer

Question Tools

Stats

pcap: network type 285 unknown or unsupported - Unable to open Marvell DSA tagged pcap file edit

1 Answer

Comments

Your Answer

Question Tools

Stats

pcap: network type 285 unknown or unsupported - Unable to open Marvell DSA tagged pcap file