On Dec 9, 2016, at 1:37 PM, Scott Deandrea <sdeand...@apple.com> wrote:
> The link-layer header format is as follows:
> struct
> {
> // Control information
> uint16_t bcdVersion; // version of this structure
> uint8_t headerLength; // length of this structure
> uint8_t requestType; // tAppleUSBHostPacketFilterRequestType
>
> // Transfer information
> uint32_t ioLength; // amount of data requested/transferred
So, for a completed request - or a submitted request to the Default Control
Pipe - does this have any relationship to the number of bytes of payload, or is
the number of bytes of payload just "the on-the-wire length from the
pcap/pcapng header minus the link-layer header length"?
I.e., would checking that value against the actual number of bytes of payload
in the packet, for completed requests and submitted request to the Default
Control Pipe - be a useful error check, or should we just print that value
without any interpretation or checking?
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
