On Feb 13, 2011, at 3:14 PM, Martin Kaiser wrote:
> I'm working on a wireshark dissector for DVB-CI (Common Interface). The
> dissector analyzes the communication between a PC-Card module and a DVB
> receiver. It's not based on any other data link layer protocol.
>
> I defined the pcap packet data for the new DLT on
> http://www.kaiser.cx/pcap-dvbci.html
The "Packet Header" section is pcap-specific; the link-layer type values can
also be used in pcap-ng captures. In addition, note that tools that read pcap
files - including Wireshark! - will not guarantee that they will interpret the
time stamp in pcap records as anything other than UN*X time values, i.e. they
won't be interpreted as "from the beginning of the capture", and values of 0
will be interpreted as January 1, 1970, 00:00:00 UTC.
If you want to say "no time stamp", use pcap-ng Simple Packet Blocks:
http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionpbs
I think the right way to handle "from the beginning of the capture" time
stamps, from my reading of the pcap-ng spec, is to put the capture start time
into the Interface Description Block in a pcap-ng file as an if_tsoffset option.
> Basically, there'll be a pseudo-header around the bytes that are
> actually transfered, hardware events can also be logged.
What follows the pseudo-header? The DVB spec you refer to says
6.2 TSI - transport layer
The transport layer used is the same as the MPEG-2 System transport
layer. Data travelling over the transport stream interface is organised in
MPEG-2 Transport Packets. The whole MPEG-2 multiplex is sent over this
transport stream interface and is received back fully or partly descrambled. If
the packet is not scrambled, the module returns it as is. If it is scrambled
and the packet belongs to the selected service and the module can give access
to that service, then the module returns the corresponding descrambled packet
with the trans- port_scrambling_control flag set to '00'.
If scrambling is performed at Packetised Elementary Stream (PES) level,
then the module reacts in the same way and under the same conditions as above,
and returns the corresponding descrambled PES with the PES_scrambling_control
flag set to '00'.
The transport packet and the PES packet are completely defined in the
MPEG-2 System specification [1].
So does each packet correspond to an MPEG-2 Transport Packet, or something else?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
