Ethereal-dev: Re: [Ethereal-dev] Fix for IRIX and UNICOS/mp snoop loopback captures

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 12 Nov 2003 00:28:28 -0800
On Tue, Nov 11, 2003 at 02:36:44PM -0600, Brian Ginsbach wrote:
> The following changes fix the decoding snoop loopback captures from
> IRIX and UNICOS/mp.  With these changes loopback captures will be
> decoded rather than show up as "Raw packet data".

...except for Linux loopback captures taken with old versions of libpcap
that use DLT_NULL and a bogus header with an Ethernet type in it, which
won't be decoded properly any more.

IRIX captures are big-endian (unless there was a little-endian port
inside SGI); I assume UNICOS/mp captures are big-endian as well.

What's in the second 2 bytes of the 4-byte header?  Are they guaranteed
to be zero?