On 2/6/07, Paolo Abeni <paolo.abeni@xxxxxxxx> wrote:
> Do you have a capture file with a USB memory stick with the new pcap
> link type you can share with me?
I have updated the sample captures wiki page adding some captures with
the new data link type; you can find them here:
http://wiki.wireshark.org/SampleCaptures#head-886e340c31ca977f321c921f81cbec4c21bb7738
For reference, it looks like the usb.urb_id field is not unique for
each request/response pair.
If I use the display filter "usb.urb_id == 4138065728" on
usb_memory_stick.pcap, Wireshark (trunk rev 21105) shows frames 3, 4,
5, 6, 7 and 8. Frames 3 & 4 go together, 5 & 6 go together, and 7 & 8
do as well. The odd part is that this ID only has 32 bits. Which
version of the Linux kernel and libpcap did you use for this?
--
- Charles Lepple