Re: [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- FCS length description

[Guy Harris via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Guy Harris <gharris () sonic net>
>
> Date: Tue, 22 Dec 2020 01:23:48 -0800
>
> On Dec 22, 2020, at 1:01 AM, Guy Harris <gharris () sonic net> wrote:
>
> > They were originally intended for use with some stuff NetBSD was doing (I'd have to look into the history of the 
> > NetBSD code), but I think NetBSD stopped doing that.
>
> The commit message for the change that added the macros was:
>
> commit afbb1ce7227dc5edb291f242ed8d95cd3762fc51
> Author: Guy Harris <gharris () sonic net>
> Date:   Sat Sep 29 19:33:29 2007 +0000
>
>     Based on work from Florent Drouin, split the 32-bit link-layer type
>     field in a capture file into:
>     
>             a 16-bit link-layer type field (it's 16 bits in pcap-NG, and
>             that'll probably be enough for the foreseeable future);
>     
>             a 10-bit "class" field, indicating the group of link-layer type
>             values to which the link-layer type belongs - class 0 is for
>             regular DLT_ values, and class 0x224 grandfathers in the NetBSD
>             "raw address family" link-layer types;
>     
>             a 6-bit "extension" field, storing information about the
>             capture, such an indication of whether the packets include an
>             FCS and, if so, how many bytes of FCS are present.
>
> So what NetBSD had was a convention where a capture file could have a link-layer type that combined an AF_ value with 
> some additional bits to distinguish the value from a regular LINKTYPE_ value; I don't know what AF_ values they 
> supported for that, or where that code was, or whether it's still supported.
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers