--- Begin Message ---
On Mar 12, 2021, at 4:35 AM, Jan Adam <ja...@hilscher.com> wrote:
>> So is "the variable" the same thing as "the payload"?
>
> That is correct. To be more specific the payload is the value/content of the
> variable.
Can the variable be anything *other* than a packet of some sort? The current
set of values for the variable listed in https://kb.hilscher.com/x/brDJBw:
0x01: netANALYZER legacy frame
0x02: Ethernet (may also be a re-assembled mpacket)
0x03: mpacket
0x04: PROFIBUS frame
0x05: IO-Link frame
lists only packets of various types, but I was reading "variable" in the
programming language sense, rather than in the sense that the total content has
a "fixed part", that being the trailer, and a "variable part", that being the
packet preceding the trailer. Is the latter the sense in which the word
"variable" should be understood?
It also appears that the boundary between the payload and the trailer would be
determined by fetching the VarSize field at the end of the trailer. The first
VarSize bytes of the data would be the payload, and the remaining
sizeof(footer) bytes would be the trailer. Is that the case?
That would also indicate that the "captured length" value for a pcap record or
a pcapng block containing NETANALYZER_NG data must be >= sizeof(footer), so
that the entire footer is present.
This also means that NETANALYZER_NG data must *not* be cut off at the end by
any "slicing" process, such as capturing with a "slice length"/"snapshot
length". Is it possible that the frame in the payload is "sliced" in that
fashion?
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
