On 8/17/07, Guy Harris <[EMAIL PROTECTED]> wrote: > > [EMAIL PROTECTED] wrote: > > > Here is possible solution to resolve DCE/DTE origin of a LAPB packet. > > > > Wireshark libpcap.h has the struct pcaprec_ss990915_hdr, which has > > ifindex field ( the interface on which packet came in ). During > > capturing phase FROM_DCE or FROM_DTE will be stored into ifindex field > > of the struct pcaprec_ss990915_hdr. Knowing interface index I know > > origin, DCE or DTE. > > No, please, don't use the non-standard versions of libpcap format - and > especially don't override a completely different field. Just put an > extra byte at the beginning of the packet data.
Mirko, I emailed you off list to discuss merging our two requirements since they seemed to overlap. This is exactly (one of) the purpose(s) of the DLT I asked for, and I _do_ have extra bytes at the front for this purpose and also to convey serial link status information, perhaps you can re-use my DLT for your capture. Because of the tcpdump mailserver problem a while ago I haven't re-submitted my patches yet. I'm on vacation this week (for another 20 minutes technically), so I expect to do it on Monday, but we can discuss this next week. Fulko - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
