Re: DLT_ request

[Guy Harris <guy () alum mit edu>]

On Dec 9, 2016, at 1:37 PM, Scott Deandrea <sdeandrea () apple com> wrote:

> The link-layer header format is as follows:
> struct
> {
>    // Control information
>    uint16_t bcdVersion;        // version of this structure
>    uint8_t  headerLength;      // length of this structure
>    uint8_t  requestType;       // tAppleUSBHostPacketFilterRequestType
>
>    // Transfer information
>    uint32_t ioLength;          // amount of data requested/transferred

So, for a completed request - or a submitted request to the Default Control Pipe - does this have any relationship to 
the number of bytes of payload, or is the number of bytes of payload just "the on-the-wire length from the pcap/pcapng 
header minus the link-layer header length"?

I.e., would checking that value against the actual number of bytes of payload in the packet, for completed requests and 
submitted request to the Default Control Pipe - be a useful error check, or should we just print that value without any 
interpretation or checking?

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers