The Tektronix K12xx/15 rf5 file format uses helper files (*.stk) to identify the various protocols that are used by a certain interface. Wireshark doesn’t read these stk files, it uses a table that helps it identify which lowest layer protocol to use.
Stk file to protocol matching is handled by an Section 10.7, “User Table” with the following fields.
- Match string
- A partial match for an stk filename, the first match wins, so if you have a specific case and a general one the specific one must appear first in the list.
- Protocol
- This is the name of the encapsulating protocol (the lowest layer in the packet data) it can be either just the name of the protocol (e.g. mtp2, eth_witoutfcs, sscf-nni ) or the name of the encapsulation protocol and the “application” protocol over it separated by a colon (e.g sscop:sscf-nni, sscop:alcap, sscop:nbap, …)