Hi, On Wed, 4 Oct 2006, Guy Harris wrote:
> Anders Broman wrote: > > > I think you should use a DLT value of: > > ... > > > #define DLT_MTP3 141 /* MTP3, without pseudo-header or > > MTP2 */ > > He wants his pcap file to have 141 as the link-layer type, to have it > interpreted as raw MTP3; if he used, for example, 1, i.e. DLT_EN10MB, > Wireshark (and Ethereal, and tcpdump, and...) would interpret the file > as Ethernet, as that's what the link-layer type value says it is. > > > And possibly a > > > > #define WTAP_ENCAP_MTP2 42 > > > > #define WTAP_ENCAP_MTP3 43 > > Those are values used internally in Wireshark, not in files; a pcap > link-layer type value of 141 maps to a WTAP_ENCAP value of 43. So.......... His problem can be solved in two ways. Either his program prepends a fake Ethernet header etc. Or his program writes stuff to a text2pcap compatible text file and use that program to prepend the fake headers for him. Thanx, Jaap _______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users
