Ethereal-dev: Re: [Ethereal-dev] Fix for IRIX and UNICOS/mp snoop loopback captures

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Brian Ginsbach <ginsbach@xxxxxxxx>
Date: Wed, 12 Nov 2003 09:15:22 -0600
On Wed, Nov 12, 2003 at 12:28:28AM -0800, Guy Harris wrote:
> On Tue, Nov 11, 2003 at 02:36:44PM -0600, Brian Ginsbach wrote:
> > The following changes fix the decoding snoop loopback captures from
> > IRIX and UNICOS/mp.  With these changes loopback captures will be
> > decoded rather than show up as "Raw packet data".
> 
> ...except for Linux loopback captures taken with old versions of libpcap
> that use DLT_NULL and a bogus header with an Ethernet type in it, which
> won't be decoded properly any more.

Bummer.

> 
> IRIX captures are big-endian (unless there was a little-endian port
> inside SGI); I assume UNICOS/mp captures are big-endian as well.

Yes, AFAIK, there is only big-endian IRIX.  I believe SGI drove a
stake in to the little-endian IRIX port effort long ago.  And you
are correct that UNICOS/mp is big-endian.

> 
> What's in the second 2 bytes of the 4-byte header?  Are they guaranteed
> to be zero?

Yes, the second 2 bytes should always be zero for UNICOS/mp.  I'm
99.9% sure that the same holds true for IRIX too.