From 4599d725f63e83dd52b4725d19dba055326ad27a Mon Sep 17 00:00:00 2001 From: skarg Date: Thu, 24 Aug 2017 19:16:45 +0000 Subject: [PATCH] Added some readme info about Wireshark, extcap, and DLTs. --- bacnet-stack/demo/mstpcap/mstpcap.txt | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/bacnet-stack/demo/mstpcap/mstpcap.txt b/bacnet-stack/demo/mstpcap/mstpcap.txt index df29428d..b20f96bd 100644 --- a/bacnet-stack/demo/mstpcap/mstpcap.txt +++ b/bacnet-stack/demo/mstpcap/mstpcap.txt @@ -195,4 +195,17 @@ Locate the extcap search path. Copy the mstpcap.exe to that folder, which may not exist. Restart Wireshark, and look for "BACnet MS/TP on COMx" interfaces. Configure the interface to change baud rate. -Capture directly from the interface. \ No newline at end of file +Capture directly from the interface. + +==== Developer Info about Wireshark ExtCap ==== + +BACnet MS/TP uses a DLT (data link type) requested from and +approved by libPCAP development team, which is 165. Wireshark +includes a dissector that decodes the MS/TP packets when they +use the DLT for MS/TP. Other DLTs exist for other types, and +there are also DLTs set aside as USER DLTs. + +See the following URLs for information about ExtCap: +https://github.com/wireshark/wireshark/blob/master/doc/README.extcap +https://github.com/wireshark/wireshark/blob/master/doc/extcap_example.py +https://wiki.wireshark.org/Development/Extcap