Ethereal-dev: Re: [Ethereal-dev] aix fddi tcpdump tracefile

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Sat, 16 Nov 2002 00:41:00 -0800
On Sat, Nov 16, 2002 at 08:57:41AM +0100, Martin Regner wrote:
> There is three bytes of padding data that Ethereal 0.9.7 didn't expect. 
> With Ethereal 0.9.7 I get "Void frame", but Guy has checked in a fix that 
> should solve this, I think.

Given that he says he's reading libpcap captures, not iptrace captures,
I suspect my fix *won't* solve this, as I changed only the iptrace
packet reading code.

I suspect AIX is once again being non-standard and putting 3 padding
bytes at the beginning of each packet's data (or not *removing* that
padding).  Perhaps it is trying to be "helpful", *the fact that standard
libpcap, when reading an FDDI capture, will align packets on a 4-byte
boundary nonwithstanding*.

I will look into this when I can.  However, I expect to be at IETF
through Thursday, leaving on Sunday, so unless I get time to look at it
Saturday, I probably won't do anything about it until late next week -
and as much of Saturday will be devoted to getting a bunch of things
done that I've been neglecting, and preparing for my trip, as well as
catching dinner and a movie, there's no guarantee that I'll get time to
look at it Saturday.