Hi,
I have some trouble understanding the if_fcslen field in the Interface Description Block of a PCAPNG file.
The PCAPNG specification states the value should specify the FCS length for a given interface in bits, however this seams to lead to lead to problems in Wireshark.
I have a monitoring software that dumps frames in a PCAPNG file with a 4 byte long FCS, so I set if_fcslen to 32. When opening the dump in Wireshark, the packets do not display correctly („Malformed Packet: UDP“).
I think this is caused by Wireshark interpreting the field as a byte size, because when I set it to 4 instead of 32 everything works fine. I also tried dividing the value by 8 somewhere in the eth or ethertype dissector which worked as
well, but I forgot where I applied this hack…
Can someone confirm wether this value should be 4 or 32 to depict a 4 byte FCS?
Kind regards
Jonas