I see in documentation Wireshark supports IEEE standard 802.3 EPON and 802.3br, does this also include 100 and 1000BASE-T1?
I see in documentation Wireshark supports IEEE standard 802.3 EPON and 802.3br, does this also include 100 and 1000BASE-T1?
"Support" has different meanings here.
For link-layer types, "support" primarily means "supports capture files that can contain packets of that link-layer type".
The list of link-layer types supported by Wireshark's native capture file formats, pcap and pcapng indicates what link-layer types are supported by those files.
"Ethernet" as a generic link-layer type - LINKTYPE_ETHERNET - is independent of the physical layer; Wireshark's native capture file formats, pcap and pcapng, support 802.3-style Ethernet as a link-layer type, with the packet beginning with an Ethernet header - 6-octet destination address, 6-octet source address, and 2-octet type/length field. That can handle everything from 10BASE5 (the Big Yellow Cable) up to 400GBASE-whatever. This includes 100BASE-T1 and 1000BASE-T1.
EPON is a special case. To quote the entry in the link-layer type list for LINKTYPE_EPON:
Ethernet-over-passive-optical-network packets, starting with the last 6 octets of the modified preamble as specified by 65.1.3.2 "Transmit" in Clause 65 of Section 5 of IEEE 802.3, followed immediately by an Ethernet frame.
so that adds additional information before the Ethernet header. Clause 65 is called "Extensions of the Reconciliation Sublayer (RS) and Physical Coding Sublayer (PCS)/Physical Media Attachment (PMA) for 1000BASE-X for multipoint links and forward error correction", and it begins with "This clause describes functions for use in a 1000BASE-PX point-to-multipoint (P2MP) networks." That is only for 1000BASE-PX (802.3ah-2004), and the extra information is for additional information that 1000BASE-PX puts into the preamble before the Ethernet frame header. It's also possible to use LINKTYPE_ETHERNET for 1000BASE-PX, although it won't include that information.
802.3br is another special case. To quote the entry in the link-layer type list for LINKTYPE_ETHERNET_MPACKET:
mPackets, as specified by IEEE 802.3br Figure 99-4, starting with the preamble and always ending with a CRC field.
which also adds additional information before the Ethernet header. Again, LINKTYPE_ETHERNET could be used for that, but some information won't be included.
pcap and pcapng do not have a special link-layer type for 100/1000BASE-T1, so it's just treated as regular Ethernet.
Comments