On 2/6/07, Paolo Abeni <[EMAIL PROTECTED]> wrote: > > Do you have a capture file with a USB memory stick with the new pcap > > link type you can share with me? > > I have updated the sample captures wiki page adding some captures with > the new data link type; you can find them here: > > http://wiki.wireshark.org/SampleCaptures#head-886e340c31ca977f321c921f81cbec4c21bb7738
For reference, it looks like the usb.urb_id field is not unique for each request/response pair. If I use the display filter "usb.urb_id == 4138065728" on usb_memory_stick.pcap, Wireshark (trunk rev 21105) shows frames 3, 4, 5, 6, 7 and 8. Frames 3 & 4 go together, 5 & 6 go together, and 7 & 8 do as well. The odd part is that this ID only has 32 bits. Which version of the Linux kernel and libpcap did you use for this? -- - Charles Lepple _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
