Skip to content
AltraMayor edited this page Nov 3, 2012 · 26 revisions

Wireshark's XIA extension

Why does Wireshark show most of destination DAGs with an '!' at the front, and '*' at the edges?

The string format to print out DAGs is documented at Human readable XIP address format. From that page, one reads the following: The prefix "!" indicates that the address is invalid. Any index greater than 35 (i.e. 'z') is represented by '+', and an empty edge by '*'.

The function that tests if an address is valid or not checks many things as one can verify in the source code, for example, that the DAG is a single component, that there is no edge after an empty edge, the DAG is in topological order, etc.

This function assumes that addresses come from userland, so they cannot have chosen edges, and that is the reason most destination addresses in packets on a wire will be invalid. One may want to have a special version of this function for Wireshark, but nobody has worked on it yet.

Once an address is deemed invalid, all edges are printed out, including empty edges, in order to help with debugging cases like "-2**9", that is, an edge after an empty edge.