Re: gsmtap design/extensions?

On Apr 13, 2019, at 12:35 AM, Harald Welte <[email protected]> wrote:

> the "physical link info" is present in GSMTAP, but the granularity of
> GSMTAP frames is not user-IP frames, but "MAC blocks".  So your user =
IP
> frame might not be visible as it's still compressed, encrypted,
> fragmented, etc.

The granularity of Ethernet frames is not user IP frames, but Ethernet =
datagrams, so you user IP frame might not be visible as it's fragmented =
(the fragments might still be IP datagrams, but they would have to be =
reassembled - which Wireshark, for example, does, for those people still =
doing NFS-over-UDP :-)).

"Encrypted" may not apply there, but it *does* apply for 802.11 frames =
on a protected network (which Wireshark can decrypt, if you have 1) the =
network password for WEP or WPA-Personal and 2) the EAPOL handshake for =
WPA-Personal).=