On Thu, May 10, 2012 at 7:05 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
>
> On May 10, 2012, at 6:49 PM, Richard Sharpe wrote:
>
>> If I forcibly set the linktype to 1 when reading the first header (the
>> SHB) during pcap_live_open, then things work as I expect.
>
> 1 is LINKTYPE_ETHERNET. Does it still work if you forcibly set the linktype to 1 and
> send down the pipe a capture where the first interface *isn't* supplying Ethernet headers?
I would not expect it to. My quick fix was simply to determine if I am
getting most things correct.
> (And, as per my mail, what happens if you send down the pipe a capture where the first
> interface supplies 802.11 headers and the second interface supplies USB headers, for
> example? In that case, there *is* no linktype, there's more than one linktype.)
I would expect massive fail. However, I currently only have a pcapng
file with one IDB in it.
>> Now to figure out the communication between dumpcap and Wireshark et al.
>
> The messages from dumpcap to Wireshark on the sync pipe just say things such as "there
> are N more packets to read from the capture file" or "I've stopped writing to that capture
> file and am now writing to a capture file with this pathname"; they do not say "this capture
> has link-layer header type XXX", or even "this capture has a new interface with link-layer
> header type XXX" (given that "this capture has link-layer type XXX" is insufficient to fully
> support capturing on multiple interfaces, which 1.7.x supports).
It would seem that we need to say "this packet has link-layer type
XXX" and the pcap-opts that is passed some of the way in supports
that, it seems.
--
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)