On Oct 26, 2021, at 11:57 AM, Michael Richardson <[email protected]> wrote:
> LINKTYPE_USB_LINUX_MMAPPED 220
> USB packets, beginning with a Linux USB header, as specified by the
> struct usbmon_packet in the Documentation/usb/usbmon.txt file in the
> Linux source tree. All 64 bytes of the header are present. All fields
> in the header are in host byte order. When performing a live capture,
> the host byte order is the byte order of the machine on which the
> packets are captured. When READING A PCAP FILE, the byte order is the
> byte order for THE FILE, as specified by the FILE'S MAGIC NUMBER;
> when reading a pcapng file, the byte order is the byte order for the
> section of the pcapng file, as specified by the Section Header
> Block. For isochronous transfers, the ndesc field specifies the
> number of isochronous descriptors that follow.
So, currently, the pcap file refers to pcapng.
Perhaps the link-layer-types spec should, at the beginning, say something such
as
Some link-layer types contain data written in "host byte order". The
specifications for file formats using these link-layer types indicates how the
host byte order for the portion of a file in which a packet is written is
determined.
so that it can cover pcap, pcapng, and any other formats that might in the
future, use these link-layer types.
Then the pcap and pcapng specs should indicate that the byte order of the
framing data (such as record lengths, link-layer type values, etc.) is also
used for packets where the link-layer type includes data in "host byte order".
_______________________________________________
OPSAWG mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/opsawg
