Wireshark-users: Re: [Wireshark-users] Question about parsing raw MTP3
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 04 Oct 2006 12:25:02 -0700
Keith Fleming wrote:

Actually, the intermediate C program that takes the raw MTP3 hex data
put a 0x8d in the "link level type" 16-bit field


It's a 32-bit field.


and that fixed it!


Not surprising, given that 0x8d = 141.
I'd suggest, by the way, that the intermediate C program include <pcap.h> and use DLT_MTP3 rather than the raw value 141 or 0x8d.
As long as you're at it, unless it's already doing so, I'd suggest that it open a pcap_t with a link-layer type of DLT_MTP3 and a snapshot length of 65535 with pcap_open_dead() and use that to open a dump file with pcap_dump_open(), write the packets with pcap_dump(), and then close the dump with pcap_dump_close(). Using libpcap's code to write libpcap files is better than writing your own code (libpcap already knows how to write them, and, in the future, it'll know how to write pcap-NG files as well).