Wireshark-dev: Re: [Wireshark-dev] pcap FCS length and LT_FCS_DATALINK_EXT()
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 21 May 2013 11:57:22 -0700
On May 5, 2013, at 3:49 PM, Stephen Donnelly <Stephen.Donnelly@xxxxxxxxxx> wrote:

> In 2007 in libpcap afbb1ce7 you committed some code (possibly from Florent Drouin) adding the LT_FCS_DATALINK_EXT mechanism to record whether the capture includes information about captured FCS length, and if so what length it is.

Yes, that was from a thread with the subject "Request for a new DLT for MTP2 with FCS" from 2007, in which Florent, you, and I were the participants.

> I believe that currently only the DAG capture code supports this, and as implemented the LT_FCS_LENGTH is in units of 16-bits, e.g. 16-bit FCS returns 1, and 32-bit FCS returns 2?

Units of bits won't work, as the field is only 4 bits long, so it can't even handle 16 bits.  As units of 16 bits is already being used, we might as well go with it.

> I don't think Wireshark's pcap wiretap code currently uses this mechanism to check for FCS length, does it make sense to add it?

Yes, it does.  If you have libpcap 1.0 or later, you have pcap_datalink_ext(), so tcpdump could use it as well.