Wireshark-users: Re: [Wireshark-users] Question about parsing raw MTP3
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 04 Oct 2006 08:59:56 -0700
Anders Broman wrote:


I think you should use a DLT value of:


	...


#define DLT_MTP3  141                 /* MTP3, without pseudo-header or MTP2 */
He wants his pcap file to have 141 as the link-layer type, to have it interpreted as raw MTP3; if he used, for example, 1, i.e. DLT_EN10MB, Wireshark (and Ethereal, and tcpdump, and...) would interpret the file as Ethernet, as that's what the link-layer type value says it is. 


And possibly a

#define WTAP_ENCAP_MTP2    42

#define WTAP_ENCAP_MTP3    43
Those are values used internally in Wireshark, not in files; a pcap link-layer type value of 141 maps to a WTAP_ENCAP value of 43.