Hi,
On Wed, 4 Oct 2006, Guy Harris wrote:
> Anders Broman wrote:
>
> > I think you should use a DLT value of:
>
> ...
>
> > #define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */
>
> He wants his pcap file to have 141 as the link-layer type, to have it
> interpreted as raw MTP3; if he used, for example, 1, i.e. DLT_EN10MB,
> Wireshark (and Ethereal, and tcpdump, and...) would interpret the file
> as Ethernet, as that's what the link-layer type value says it is.
>
> > And possibly a
> >
> > #define WTAP_ENCAP_MTP2 42
> >
> > #define WTAP_ENCAP_MTP3 43
>
> Those are values used internally in Wireshark, not in files; a pcap
> link-layer type value of 141 maps to a WTAP_ENCAP value of 43.
So..........
His problem can be solved in two ways.
Either his program prepends a fake Ethernet header etc.
Or his program writes stuff to a text2pcap compatible text file and use
that program to prepend the fake headers for him.
Thanx,
Jaap