Re: Request for new Link-layer header type

[Guy Harris <guy () alum mit edu>]

On Sep 2, 2011, at 12:53 AM, <HPfrommer () hilscher com> <HPfrommer () hilscher com> wrote:

> > > uiTransparent:
> > > 0: normal Ethernet mode
> > > 1: transparent capture mode
> >
> > Is there any difference between the packets in those two modes?
>
> Yes, this will include the preamble/SFD as supplied by the Ethernet-PHY.
> This is used as low-level analysis expert mode.
>
> pcaprec_hdr_t:
>    ts_sec
>    ts_usec
>    incl_len
>    orig_len
> packet_data:
>    preamble
>    SFD
>    dst_mac
>    src_mac
>    len_type
>    fcs
>  NETANA_HEADER_T

Will there ever be both "normal mode" and "transparent mode" packets in the same capture file?  If not, perhaps 
transparent mode should have its own link-layer type value.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.