search

IETF-OPSAWG-WG / draft-ietf-opsawg-pcap

PCAP next generation file format specification
Other
264 stars 59 forks source link

pcap figure 1 --- Link Type #106

Closed mcr closed 2 years ago

mcr commented 3 years ago

I think bytes 20 through 24 of the File Header (Fig 1) are incorrect. Perhaps you meant to have the LinkType field come first, at least for a little-endian machine?

The upper 32 bits of what was originally a 32-bit link-layer type field were stolen for FCS information (and, originally, other purposes that NetBSD had, but it no longer seems to use them for that purpose).

So if you view that field as a 32-bit value, with the bit on the right being the least-significant bit, and the bit on the left being the most-significant bit, that figure is correct.

I.e., it's correct after the field is converted to host byte order. In the file, that's not the case.

It should probably be described as a 32-bit link-layer type plus additional information field, so people know that it has to be converted to host byte order as a 32-bit quantity, with the subfields described below that.

guyharris commented 2 years ago

Fixed by commit bdd3d5ba51a722bde4372c5f57c1dc29b02b4348.