Wireshark · Wireshark-dev: Re: [Wireshark-dev] USB URB hex bytes not shown

[Guy Harris <guy@xxxxxxxxxxxx>]

On Apr 8, 2010, at 11:28 AM, Maynard, Chris wrote:

> For DLT_USB_LINUX, is there any good reason why the pcap_usb_header information (from libpcap’s pcap/usb.h file) is only displayed in the “packet details” pane, but the hex bytes don’t appear in the “packet bytes” pane?  (See attached sample capture file containing a single frame depicting this.)

The reason is that, for better or worse, that's treated by the Wiretap library code that reads it as a "pseudo-header".

Whether that's a *good* reason is another matter.

Note that the data in question is in the host byte order of the machine on which the capture was done, so if the data were to be fetched from a tvbuff, it would have to be fetched in that byte order.  That information is available (although it gets more complicated with pcap-ng, as the byte order is per-section, *not* per-interface, so, for example, if multiple pcap-ng captures, including one or more USB interfaces, were to be merged, the pcap_usb_header information would have to be put into the appropriate byte order when writing the capture).