Skip to content

Commit 62a6477

Browse files
committed
pcap savefile: Update about "link-layer type and additional information"
Update based on draft-ietf-opsawg-pcap. [skip ci]
1 parent 1be8367 commit 62a6477

File tree

2 files changed

+49
-4
lines changed

2 files changed

+49
-4
lines changed

Makefile.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -883,7 +883,7 @@ releasecheck: releasetar
883883

884884
whitespacecheck:
885885
@# trailing space(s)?
886-
@if git grep -I -n ' $$' $$(git ls-files|grep -v '^tests/'); then \
886+
@if git grep -I -n ' $$' $$(git ls-files|grep -vE '^(tests/|pcap-savefile.manfile.in$$)'); then \
887887
echo 'Error: Trailing space(s).'; \
888888
exit 1; \
889889
fi

pcap-savefile.manfile.in

Lines changed: 48 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ Reserved2
4747
_
4848
Snapshot length
4949
_
50-
Link-layer header type
50+
Link-layer header type and additional information
5151
.TE
5252
.RE
5353
.PP
@@ -100,12 +100,57 @@ bytes of a packet longer than
100100
.I N
101101
bytes will be saved in the capture.
102102
.IP
103-
a 4-byte number giving the link-layer header type for packets in the
104-
capture; see
103+
A 4-byte number giving the link-layer header type for packets in the
104+
capture and optional additional information.
105+
.IP
106+
This format of this field is:
107+
.PP
108+
.RS
109+
1 2 3
110+
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
111+
.TS
112+
box;
113+
c s
114+
c
115+
c s.
116+
FCS len|R|P| Reserved3 | Link-layer type
117+
.TE
118+
.RE
119+
.IP
120+
The field is shown as if it were in the byte order of the host reading
121+
or writing the file, with bit 0 being the most-significant bit of the
122+
field and bit 31 being the least-significant bit of the field.
123+
.IP
124+
Link-layer type (16 bits):
125+
A 16-bit value giving the link-layer header type for packets in the file;
126+
see
105127
.BR pcap-linktype (@MAN_MISC_INFO@)
106128
for the
107129
.B LINKTYPE_
108130
values that can appear in this field.
131+
.IP
132+
Reserved3 (10 bits):
133+
not used - MUST be set to zero by pcap writers, and MUST NOT be
134+
interpreted by pcap readers; a reader SHOULD treat a non-zero value as
135+
an error.
136+
.IP
137+
P (1 bit):
138+
A bit that, if set, indicates that the Frame Check Sequence (FCS)
139+
length value is present and, if not set, indicates that the FCS value is
140+
not present.
141+
.IP
142+
R (1 bit):
143+
not used - MUST be set to zero by pcap writers, and MUST NOT be
144+
interpreted by pcap readers; a reader SHOULD treat a non-zero value as
145+
an error.
146+
.IP
147+
FCS len (4 bits):
148+
A 4-bit unsigned value giving the number of 16-bit (2-octet) words
149+
of FCS that are appended to each packet, if the P bit is set; if the P
150+
bit is not set, and the FCS length is not indicated by the link-layer
151+
type value, the FCS length is unknown. The valid values of the FCS len
152+
field are between 0 and 15; Ethernet, for example, would have an FCS
153+
length value of 2, corresponding to a 4-octet FCS.
109154
.PP
110155
Following the per-file header are zero or more packets; each packet
111156
begins with a per-packet header, which is immediately followed by the

0 commit comments

Comments
 (0)