Briefly, and hopefully I get all this right! ?…

X.25 defines a layer 3 encapsulation, like IP, but as I understand, the destination address in an X.25 packet is only significant to the interface on which it is received.?

X.28 defines the operation of the PAD, or packet assembler/disassembler. ?This is just a term of art for something more commonly known in the TCP/IP world as a terminal server. This standard defines things like how the PAD operates, the prompts it presents the user, the commands it accepts from the user.

X.29 is the encapsulation for a “call” over x.25 and is analogous to telnet over TCP.

X.3 is a set of characteristics sent between the endpoints of an x.29 call and is analogous to telnet options, like if the call is character or line buffered, who (if anyone) should echo too the caller, etc.

Xotpad performs all of these things entirely in software, and encapsulates the x.25 packet in TCP (aka XOT), where the distant end will de-encapsulate and process the x.25 packet.

A Cisco can do XOT, but can also do LAPB, which is the native layer 2 encapsulation used for x.25 packets over serial interfaces.

I recommend xotpad and wireshark because it may be easier to start simple, inspect the packets, and understand how the protocol works a bit before involving things that are a little harder to troubleshoot. ?That said, the Cisco implementation is decades old and has seen a lot of use, so is pretty robust.