Re: [tcpdump-workers] DLT_ request

2016-12-09 Thread Scott Deandrea
Hi Guy, For the initial release I’m planning to use 0x0100 for the bcdVersion. All length values are in bytes. tAppleUSBHostPacketFilterRequestType doesn’t exist in public domain at this point. It tracks when a request was enqueued and when it completed and it is defined as follows: enum t

Re: [tcpdump-workers] DLT_ request

2016-12-09 Thread Guy Harris
On Dec 9, 2016, at 1:37 PM, Scott Deandrea wrote: > The link-layer header format is as follows: So are multi-byte integral fields in the byte order of the host providing the packets, always in little-endian order (if, for example, Apple were to go Power ISA again, they'd be little-endian even

Re: [tcpdump-workers] DLT_ request

2016-12-09 Thread Guy Harris
On Dec 9, 2016, at 1:37 PM, Scott Deandrea wrote: > The link-layer header format is as follows: > struct > { >// Control information >uint16_t bcdVersion;// version of this structure What's the current version? 0, 1, or something else? >uint8_t headerLength; // length

Re: [tcpdump-workers] DLT_ request

2016-12-09 Thread Scott Deandrea
Hi Guy, Nothing has shipped with any version of macOS yet; indeed I’m trying to avoid the mistake that was made with DLT_USER2 and PKTAP. The link-layer header format is as follows: struct { // Control information uint16_t bcdVersion;// version of this structure uint8_t head