Re: USB URB hex bytes not shown

["Maynard, Chris" <Christopher.Maynard () GTECH COM>]

Hmm, I'm still confused.  Byte order aside, the "packet details" pane contains information from the "pseudo-header".  
For example, in the example capture file I sent, the URB id filed is displayed as:

        URB id: 0xffff810024eaab40

But nowhere in the "packet bytes" pane do those bytes appear.

Contrast this with the attached example of a Linux cooked capture where the cooked pseudo header is present and the hex 
bytes are also shown.  Selecting each of the fields within the cooked header highlights the corresponding bytes in the 
"packet bytes" pane.  I guess I would expect the same behavior for DLT_USB_LINUX as we get for DLT_LINUX_SLL.

- Chris


-----Original Message-----
From: wireshark-dev-bounces () wireshark org [mailto:wireshark-dev-bounces () wireshark org] On Behalf Of Guy Harris
Sent: Thursday, April 08, 2010 2:34 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] USB URB hex bytes not shown


On Apr 8, 2010, at 11:28 AM, Maynard, Chris wrote:

> For DLT_USB_LINUX, is there any good reason why the pcap_usb_header information (from libpcap's pcap/usb.h file) is 
> only displayed in the "packet details" pane, but the hex bytes don't appear in the "packet bytes" pane?  (See 
> attached sample capture file containing a single frame depicting this.)

The reason is that, for better or worse, that's treated by the Wiretap library code that reads it as a "pseudo-header".

Whether that's a *good* reason is another matter.

Note that the data in question is in the host byte order of the machine on which the capture was done, so if the data 
were to be fetched from a tvbuff, it would have to be fetched in that byte order.  That information is available 
(although it gets more complicated with pcap-ng, as the byte order is per-section, *not* per-interface, so, for 
example, if multiple pcap-ng captures, including one or more USB interfaces, were to be merged, the pcap_usb_header 
information would have to be put into the appropriate byte order when writing the capture).
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
CONFIDENTIALITY NOTICE: The contents of this email are confidential
and for the exclusive use of the intended recipient. If you receive this
email in error, please delete it from your system immediately and 
notify us either by email, telephone or fax. You should not copy,
forward, or otherwise disclose the content of the email.

Attachment: cookedex.pcap
Description: cookedex.pcap

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe