@@ -47,7 +47,7 @@ Reserved2
4747_
4848Snapshot length
4949_
50- Link-layer header type
50+ Link-layer header type and additional information
5151.TE
5252.RE
5353.PP
@@ -100,12 +100,57 @@ bytes of a packet longer than
100100.I N
101101bytes will be saved in the capture.
102102.IP
103- a 4-byte number giving the link-layer header type for packets in the
104- capture; see
103+ A 4-byte number giving the link-layer header type for packets in the
104+ capture and optional additional information.
105+ .IP
106+ This format of this field is:
107+ .PP
108+ .RS
109+ 1 2 3
110+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
111+ .TS
112+ box;
113+ c s
114+ c
115+ c s.
116+ FCS len|R|P| Reserved3 | Link-layer type
117+ .TE
118+ .RE
119+ .IP
120+ The field is shown as if it were in the byte order of the host reading
121+ or writing the file, with bit 0 being the most-significant bit of the
122+ field and bit 31 being the least-significant bit of the field.
123+ .IP
124+ Link-layer type (16 bits):
125+ A 16-bit value giving the link-layer header type for packets in the file;
126+ see
105127.BR pcap-linktype (@MAN_MISC_INFO@)
106128for the
107129.B LINKTYPE_
108130values that can appear in this field.
131+ .IP
132+ Reserved3 (10 bits):
133+ not used - MUST be set to zero by pcap writers, and MUST NOT be
134+ interpreted by pcap readers; a reader SHOULD treat a non-zero value as
135+ an error.
136+ .IP
137+ P (1 bit):
138+ A bit that, if set, indicates that the Frame Check Sequence (FCS)
139+ length value is present and, if not set, indicates that the FCS value is
140+ not present.
141+ .IP
142+ R (1 bit):
143+ not used - MUST be set to zero by pcap writers, and MUST NOT be
144+ interpreted by pcap readers; a reader SHOULD treat a non-zero value as
145+ an error.
146+ .IP
147+ FCS len (4 bits):
148+ A 4-bit unsigned value giving the number of 16-bit (2-octet) words
149+ of FCS that are appended to each packet, if the P bit is set; if the P
150+ bit is not set, and the FCS length is not indicated by the link-layer
151+ type value, the FCS length is unknown. The valid values of the FCS len
152+ field are between 0 and 15; Ethernet, for example, would have an FCS
153+ length value of 2, corresponding to a 4-octet FCS.
109154.PP
110155Following the per-file header are zero or more packets; each packet
111156begins with a per-packet header, which is immediately followed by the
0 commit comments