Anders Broman wrote:
I think you should use a DLT value of:
...
#define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */
He wants his pcap file to have 141 as the link-layer type, to have it
interpreted as raw MTP3; if he used, for example, 1, i.e. DLT_EN10MB,
Wireshark (and Ethereal, and tcpdump, and...) would interpret the file
as Ethernet, as that's what the link-layer type value says it is.
And possibly a
#define WTAP_ENCAP_MTP2 42
#define WTAP_ENCAP_MTP3 43
Those are values used internally in Wireshark, not in files; a pcap
link-layer type value of 141 maps to a WTAP_ENCAP value of 43.