Wireshark-bugs: [Wireshark-bugs] [Bug 6260] Saving ERF files.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6260
--- Comment #11 from Guy Harris <guy@xxxxxxxxxxxx> 2011-08-31 20:32:33 PDT ---
The ERF dissector has a preference to indicate whether the packet has an FCS or
not. I infer, perhaps incorrectly, that this means that, in ERF files,
Ethernet packets don't necessarily have an FCS.
If that's not true and has never been true - i.e., if no ERF capture file has
*ever*, in the history of the ERF file format, had Ethernet packets without an
FCS - the preference should be eliminated and the ERF dissector should always
call the "eth_withfcs" dissector, which skips the "does this packet look as if
it has an FCS" heuristic and always treats the last 4 octets of the packet as
an FCS.
If that *is* true, then:
1) the preference should still be there;
2) other software that handles ERF files has to be able to deal with it, so
there's no need to add a synthesized FCS to the packet;
3) you should set that preference to see the last 4 octets treated as an
FCS.
Given that Endace contributed code to add a synthesized FCS, I assume "that's
not true and has never been true" is the case, and we should remove the
preference from the ERF dissector. If my assumption is incorrect....
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
