Ethereal-dev: Re: [Ethereal-dev] Fix for IRIX and UNICOS/mp snoop loopback captures

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 12 Nov 2003 00:28:28 -0800
On Tue, Nov 11, 2003 at 02:36:44PM -0600, Brian Ginsbach wrote:
> The following changes fix the decoding snoop loopback captures from
> IRIX and UNICOS/mp.  With these changes loopback captures will be
> decoded rather than show up as "Raw packet data".

...except for Linux loopback captures taken with old versions of libpcap
that use DLT_NULL and a bogus header with an Ethernet type in it, which
won't be decoded properly any more.

IRIX captures are big-endian (unless there was a little-endian port
inside SGI); I assume UNICOS/mp captures are big-endian as well.

What's in the second 2 bytes of the 4-byte header?  Are they guaranteed
to be zero?