No, the ERF type 5 record has a different header than the PCAP header, but
MTP2 part is not affected.
In fact, the MTP2 (FCS) is not specific to the ERF format, I would say,
MTP2 (FCS) is the standart MTP2, but the checksums are present in the 2
last bytes of the frame.
I could use a new DLT, but this would be to show the additional
informations given in the ERF type 5 header (like a kind of timeslot
information, etc)
Best regards
Florent
Jeff Morriss
<jeff.morriss@xxxxxxxxxx To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
m> cc:
Sent by: Subject: Re: [Wireshark-dev] Patch to decode ERF type 5 record
wireshark-dev-bounces@wi
reshark.org
02/02/2007 02:31
Please respond to
Developer support list
for Wireshark
Florent.Drouin@xxxxxxxxxxxxxxxxx wrote:
> This patch add the decoding of ERF files using the type "Multi Channel
> HDLC".
Does this file format include the MTP2 FCS? If so, as per my previous
email about the MTP2 patch, (at least) a new WTAP_ENCAP is needed to
distinguish between MTP2 with and without the FCS.
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev