--- Begin Message ---
Hello,
The layout is
https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_header
following by one or more
https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_header_extended_data_item
depending of the flag _EVENT_HEADER.F
--- Begin Message ---
On Jun 2, 2020, at 12:22 AM, Airbus CERT via tcpdump-workers
wrote:
> Yes exactly each packet is an event. The layout of the event is
> https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_header
> and
> https://docs.microsoft.com/en-us/windows/w
--- Begin Message ---
Hello libpcap team,
Yes exactly each packet is an event. The layout of the event is
https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_header
and
https://docs.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_header_extended_data_i
