No, the ERF type 5 record has a different header than the PCAP header, but MTP2 part is not affected. In fact, the MTP2 (FCS) is not specific to the ERF format, I would say, MTP2 (FCS) is the standart MTP2, but the checksums are present in the 2 last bytes of the frame.
I could use a new DLT, but this would be to show the additional
informations given in the ERF type 5 header (like a kind of timeslot
information, etc)
Best regards
Florent
Jeff Morriss
<[EMAIL PROTECTED] To: Developer support
list for Wireshark <[email protected]>
m> cc:
Sent by: Subject: Re:
[Wireshark-dev] Patch to decode ERF type 5 record
[EMAIL PROTECTED]
reshark.org
02/02/2007 02:31
Please respond to
Developer support list
for Wireshark
[EMAIL PROTECTED] wrote:
> This patch add the decoding of ERF files using the type "Multi Channel
> HDLC".
Does this file format include the MTP2 FCS? If so, as per my previous
email about the MTP2 patch, (at least) a new WTAP_ENCAP is needed to
distinguish between MTP2 with and without the FCS.
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
