On Oct 26, 2021, at 11:57 AM, Michael Richardson <mcr+i...@sandelman.ca> wrote:
> LINKTYPE_USB_LINUX_MMAPPED 220 > USB packets, beginning with a Linux USB header, as specified by the > struct usbmon_packet in the Documentation/usb/usbmon.txt file in the > Linux source tree. All 64 bytes of the header are present. All fields > in the header are in host byte order. When performing a live capture, > the host byte order is the byte order of the machine on which the > packets are captured. When READING A PCAP FILE, the byte order is the > byte order for THE FILE, as specified by the FILE'S MAGIC NUMBER; > when reading a pcapng file, the byte order is the byte order for the > section of the pcapng file, as specified by the Section Header > Block. For isochronous transfers, the ndesc field specifies the > number of isochronous descriptors that follow. So, currently, the pcap file refers to pcapng. Perhaps the link-layer-types spec should, at the beginning, say something such as Some link-layer types contain data written in "host byte order". The specifications for file formats using these link-layer types indicates how the host byte order for the portion of a file in which a packet is written is determined. so that it can cover pcap, pcapng, and any other formats that might in the future, use these link-layer types. Then the pcap and pcapng specs should indicate that the byte order of the framing data (such as record lengths, link-layer type values, etc.) is also used for packets where the link-layer type includes data in "host byte order". _______________________________________________ OPSAWG mailing list OPSAWG@ietf.org https://www.ietf.org/mailman/listinfo/opsawg