This wiki has been migrated to https://gitlab.com/wireshark/wireshark/-/wikis/home and is now deprecated. Please use that site instead.

ISO transport services on top of the TCP (TPKT)

"Emulate" ISO transport services ["COTP"] on top of ["TCP"]. The two major points missing in TCP (compared to ["COTP"]) are the TSAP addressing and the detection of packet boundaries on the receiving host. See the IsoProtocolFamily page for an overview.

History

As TCP becomes more and more popular (around 1995?), a mechanism was needed to encapsulate ISO services on top of TCP transport, as both protocols have similiar tasks and ["COTP"] was becoming obsolete these days.

Protocol dependencies

Example traffic

XXX - Add example traffic here (as plain text or Ethereal screenshot).

Ethereal

The TPKT dissector is fully functional.

Preference Settings

(XXX add links to preference settings affecting how PROTO is dissected).

Example capture file

XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of TPKT display filter fields can be found in the [http://www.ethereal.com/docs/dfref/t/tpkt.html display filter reference]

Capture Filter

You can filter TPKT protocols while capturing, as it's always using TCP port 102.

Discussion