add RFC1006 and spec titles
|Deletions are marked like this.||Additions are marked like this.|
|Line 24:||Line 24:|
|(XXX add links to preference settings affecting how PROTO is dissected).||* Wether TPKT packets spanning multiple TCP segments should be reassembled or not, for VoIP traffic this setting is essential.|
|Line 45:||Line 45:|
|* add link to TPKT specification and where to find additional info on the web about TPKT|| * [http://www.ietf.org/rfc/rfc1006.txt?number=1006 RFC1006] ''ISO Transport Service on top of the TCP Version: 3''
* [http://www.ietf.org/rfc/rfc2126.txt?number=2126 RFC2126] ''ISO Transport Service on top of TCP (ITOT)''
ISO transport services on top of the TCP (TPKT)
"Emulate" ISO transport services ["COTP"] on top of ["TCP"]. The two major points missing in TCP (compared to ["COTP"]) are the TSAP addressing and the detection of packet boundaries on the receiving host. See the IsoProtocolFamily page for an overview.
As TCP becomes more and more popular (around 1995?), a mechanism was needed to encapsulate ISO services on top of TCP transport, as both protocols have similiar tasks and ["COTP"] was becoming obsolete these days.
- ["TCP"]: Typically, TPKT uses ["TCP"] as its transport protocol. The well known TCP port for TPKT traffic is 102.
XXX - Add example traffic here (as plain text or Ethereal screenshot).
The TPKT dissector is fully functional.
* Wether TPKT packets spanning multiple TCP segments should be reassembled or not, for VoIP traffic this setting is essential.
Example capture file
XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.
A complete list of TPKT display filter fields can be found in the [http://www.ethereal.com/docs/dfref/t/tpkt.html display filter reference]
Show only the TPKT based traffic:
You can filter TPKT protocols while capturing, as it's always using TCP port 102.
Capture only the TPKT based traffic (you will only see TPKT, but not additions like the corresponding ARP packets):
tcp port 102
[http://www.ietf.org/rfc/rfc1006.txt?number=1006 RFC1006] ISO Transport Service on top of the TCP Version: 3
[http://www.ietf.org/rfc/rfc2126.txt?number=2126 RFC2126] ISO Transport Service on top of TCP (ITOT)