Keith Fleming wrote:
Actually, the intermediate C program that takes the raw MTP3 hex data
put a 0x8d in the "link level type" 16-bit field
It's a 32-bit field.
and that fixed it!
Not surprising, given that 0x8d = 141.
I'd suggest, by the way, that the intermediate C program include
<pcap.h> and use DLT_MTP3 rather than the raw value 141 or 0x8d.
As long as you're at it, unless it's already doing so, I'd suggest that
it open a pcap_t with a link-layer type of DLT_MTP3 and a snapshot
length of 65535 with pcap_open_dead() and use that to open a dump file
with pcap_dump_open(), write the packets with pcap_dump(), and then
close the dump with pcap_dump_close(). Using libpcap's code to write
libpcap files is better than writing your own code (libpcap already
knows how to write them, and, in the future, it'll know how to write
pcap-NG files as well).