Support General Packet Radio Service Logical Link Control - datalink type 169

Open boozer-zz opened this issue 12 years ago • 2 comments

I'm trying to analyze .pcap files with tcpflow -r tcp and get "sorry - unknown datalink type 169 on interface" The files I want to analyse are not generated by tcpflow. Am I doing something wrong or is there a problem with my files?

Feb 13 '14 08:02 boozer-zz

Ok. I read a little bit and I think my pcaps are ok, but no tool besides wireshark/tshark seems to support "General Packet Radio Service Logical Link Control" or am I mistaken?

If so is there any way to reconstruct the tcp ascii data from my pcaps with tcpflow, tshark or any other tool?

P.S. The problem with tshark is not compatibility, but rather that it stops reconstructing a flow on the first missing/broken package in a flow

Feb 13 '14 09:02 boozer-zz

It's really not hard to add support for another packet format. You just need to know the offset where the data begins. Look at the file datalink.cpp

Feb 13 '14 13:02 simsong