23 Oct
2018
23 Oct
'18
3:38 p.m.
Earlier today I wrote:
The packet in question is an init packet, used to
start up a link.
If tcpdump knew about this, it would look somewhat like:
Since there really is a need for a tool to examine various kinds of DEC
protocol traffic, I am trying to put one together. In case anyone is
interested:
http://https://www.pdc.kth.se/~bygg/tops/anfdump.tar
Don't let the ANF part of the name fool you! It can do the following:
* listen for ethernet frames with ANF-10, DECnet and LAT.
* listen for DDCMP (simh-style over TCP or UDP), with decoding
of payload (ANF-10 or DECnet).
* listen for Multinet over TCP, with decoding of DECnet.
* do several of the above, in parallel, if you want to see how
a box in the middle molests your data.
* read (and write) pcap-format files.
As usual this is a work-in-progress, and some things (like the manual)
are missing, but the code mostly works. Use the -h flag for help at
this time.
--Johnny
23 Oct
23 Oct
2:10 p.m.
This is great Johnny - I have been using tshark the best I could so far; your tool will be
vastly more helpful.
The circuit with MIM fluctuated for quite a while, I suspect at least an hour. Wonder if
anyone else saw that too; if not, there was an unusual network issue with Amazon AWS or
somewhere trans-Atlantic.
Thank you,
Supratim
On Oct 23, 2018, at 8:05 AM, Johnny Eriksson <bygg
at cafax.se> wrote:
Earlier today I wrote:
The packet in question is an init packet, used to
start up a link.
If tcpdump knew about this, it would look somewhat like:
Since there really is a need for a tool to examine various kinds of DEC
protocol traffic, I am trying to put one together. In case anyone is
interested:
http://https://www.pdc.kth.se/~bygg/tops/anfdump.tar
Don't let the ANF part of the name fool you! It can do the following:
* listen for ethernet frames with ANF-10, DECnet and LAT.
* listen for DDCMP (simh-style over TCP or UDP), with decoding
of payload (ANF-10 or DECnet).
* listen for Multinet over TCP, with decoding of DECnet.
* do several of the above, in parallel, if you want to see how
a box in the middle molests your data.
* read (and write) pcap-format files.
As usual this is a work-in-progress, and some things (like the manual)
are missing, but the code mostly works. Use the -h flag for help at
this time.
--Johnny 
3:10 p.m.
On 2018-10-23 14:10, Supratim Sanyal wrote:
This is great Johnny - I have been using tshark the
best I could so far; your tool will be vastly more helpful.
Indeed. That sounds like a very useful tool, Johnny. Would love to check
it out. It is sometimes very tedious to inspect both actual packets, and
packets wrapped inside another layer.
A suggestion for the tool would be for it to also be able to process
packets as wrapped by my bridge. They are very simple. Just full
ethernet frames inside UDP packets.
The circuit with MIM fluctuated for quite a while, I
suspect at least an hour. Wonder if anyone else saw that too; if not, there was an unusual
network issue with Amazon AWS or somewhere trans-Atlantic.
I was doing a bunch of work, and was restarting MIM many types last
night. I suspect that is what you saw.
Johnny
Thank you,
Supratim
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
On Oct 23, 2018, at 8:05 AM, Johnny Eriksson
<bygg at cafax.se> wrote:
Earlier today I wrote:
The packet in question is an init packet, used to
start up a link.
If tcpdump knew about this, it would look somewhat like:
Since there really is a need for a tool to examine various kinds of DEC
protocol traffic, I am trying to put one together. In case anyone is
interested:
http://https://www.pdc.kth.se/~bygg/tops/anfdump.tar
Don't let the ANF part of the name fool you! It can do the following:
* listen for ethernet frames with ANF-10, DECnet and LAT.
* listen for DDCMP (simh-style over TCP or UDP), with decoding
of payload (ANF-10 or DECnet).
* listen for Multinet over TCP, with decoding of DECnet.
* do several of the above, in parallel, if you want to see how
a box in the middle molests your data.
* read (and write) pcap-format files.
As usual this is a work-in-progress, and some things (like the manual)
are missing, but the code mostly works. Use the -h flag for help at
this time.
--Johnny
4:09 p.m.
On 10/23/2018 09:10, Johnny Billquist wrote:
On 2018-10-23 14:10, Supratim Sanyal wrote:
Great tool!
$ sudo ./anfdump -p 6003 -i br-decnet
14:06:19.763172 br-decnet ETH 6003 aa:00:04:00:27:06 > ab:00:00:03:00:00
len 60
? Ethernet endnode hello, aa:00:04:00:27:06 (1.551)
?? info 3 size 1498 ver 2/0/0 timer 15, router aa:00:04:00:2f:06 (1.559)
14:06:20.788110 br-decnet ETH 6003 aa:00:04:00:2f:06 > ab:00:00:03:00:00
len 1450
? Routing (level 1), 1.559
??? node 0 - 31
??? node 32 - 63
??? node 64 - 95
??? node 96 - 127
??? node 128 - 159
??? node 160 - 191
??? node 192 - 223
??? node 224 - 255
??? node 256 - 287
??? node 288 - 319
??? node 320 - 351
??? node 352 - 383
??? node 384 - 415
??? node 416 - 447
??? node 448 - 479
??? node 480 - 511
??? node 512 - 543
??? node 544 - 575
??? node 576 - 607
??? node 608 - 639
??? node 640 - 671
14:06:20.790057 br-decnet ETH 6003 aa:00:04:00:2f:06 > ab:00:00:03:00:00
len 770
? Routing (level 1), 1.559
??? node 672 - 703
??? node 704 - 735
??? node 736 - 767
??? node 768 - 799
??? node 800 - 831
??? node 832 - 863
??? node 864 - 895
??? node 896 - 927
??? node 928 - 959
??? node 960 - 991
??? node 992 - 1023
14:06:20.790067 br-decnet ETH 6003 aa:00:04:00:2f:06 > ab:00:00:03:00:00
len 152
? Routing (level 2), 1.559
??? area 1 - 63
14:06:20.790070 br-decnet ETH 6003 aa:00:04:00:2f:06 > 09:00:2b:02:00:00
len 152
? Routing (level 2), 1.559
??? area 1 - 63
14:06:21.436049 br-decnet ETH 6003 aa:00:04:00:2e:06 > ab:00:00:03:00:00
len 60
? Ethernet endnode hello, aa:00:04:00:2e:06 (1.558)
?? info 3 size 1498 ver 2/0/0 timer 15, router aa:00:04:00:2f:06 (1.559)
14:06:22.569978 br-decnet ETH 6003 aa:00:04:00:3a:06 > ab:00:00:03:00:00
len 60
? Ethernet endnode hello, aa:00:04:00:3a:06 (1.570)
?? info 3 size 1498 ver 2/0/0 timer 6, router aa:00:04:00:2f:06 (1.559)
^CSignal!
This is great Johnny - I have been using tshark
the best I could so
far; your tool will be vastly more helpful.
Indeed. That sounds like a very useful tool, Johnny. Would love to
check it out. It is sometimes very tedious to inspect both actual
packets, and packets wrapped inside another layer.
I was doing a bunch of work, and was restarting MIM many types last
night. I suspect that is what you saw.
? Johnny
That explains it, thanks. No need to worry about AWS.
Supratim
2221
days inactive
2221
days old
3 comments
3 participants
participants (3)
-
bqt＠softjar.se -
bygg＠cafax.se -
supratim＠riseup.net