Wireshark · Wireshark-dev: Re: [Wireshark-dev] NetXRay 2.2 fileformat

[Guy Harris <guy@xxxxxxxxxxxx>]

Stig Bjørlykke wrote:

> They are at the end of each frame.

Looks like the same sort of stuff we've seen in other captures.

I checked in a change to make the code that handles LAPB packets do the 
same check for two bytes in the record header to decide whether there's 
4 bytes of junk at the end of the packet that we do for other types. 
That seems to fix the capture you sent, at least; try it on other captures.

Anybody else with Windows Sniffer X.25 captures should also check this, 
to see if it breaks anything.

> Sometimes they have data and 
> sometimes they are only zero's, so it may be junk.

Do the first 16 bits of the data look, in some packets, as if they're 
random enough that they might be an FCS?