RedBack Smartedge pcap format
The RedBack Smartedge is an Edge Subscriber Terminating router. It is designed around a PowerPC-based NetBSD and intelligent packet forwarding linecards. From the NetBSD, the linecards appear as interfaces one can issue a tcpdump on. As the linecards do packet forwarding themselves, one only sees traffic destined or originating from the Route Processor called XCRP. Typically, you'll see RADIUS, ARP, PPPoE, L2TP Tunnel/Session Setup/Drop, Routing Protocols.
The packet processing is based on circuits, and RedBack has extended the pcap format with additional information concerning protocol and circuit information. The linecards are able to perform Ethernet encapsulation/decapsulation themselves, so some packets are pure IP, while others are Ethernet encapsulated, etc.
Knowledge about this format has basically been gained by reverse engineering the tcpdump output on the SEOS. It is not complete, and there are messages which seem to be proprietary and thus cannot be displayed properly.
The wireshark loader has been tested with SEOS 2.6.5.2, 4.0.7.0 and 4.0.7.1
