On Tue, Jun 24, 2003 at 05:14:56PM +0530, Navin Anand wrote:
> The modified files are:
> libpcap.c
> 407,413d406
> <
> < /*
> < * 20 Added for the fake link type, required to dissect packets
> < * containing higher layer protocol payload without the lower layer
> < * protocol headers, e.g. pure TCP data without underlying IP.
> < */
> < { 20, WTAP_ENCAP_FAKE_LINK },
There is no guarantee that a DLT_ value of 20 isn't being used
somewhere; it's best to request a DLT_ value from tcpdump.org - or to
define your own capture file format for your application, with its own
magic number, rather than using libpcap format. (The format could be
the same as libpcap format, except for the file header, which could, for
example, contain a value specifying the lowest-level protocol layer, if
that's the same for all packets in the capture, and which would have a
differrent magic number.
Note that, of course, there are places where the TCP dissector expects
to have an IP address for each packet, and thus expects there to be an
IP header; other protocols, such as SCCP, might make similar
assumptions. They might have to be modified to handle, for example, the
source and destination addresses being AT_NONE rather than, say, AT_IPv4
or AT_IPv6.