On Sun, Mar 13, 2011 at 2:41 PM, Guy Harris <[email protected]> wrote: > http://www.tcpdump.org/linktypes.html > > contains a description of all the existing link-layer header types for which > there is either
Not sure why there is two link types for IEEE 802.15.4. The "no FCS at the end" case doesn't need a link type, if the snaplen is 2 bytes shorter than the packet should be, then there is no FCS at the end. Since every decoder needs to know how to deal with a snaplen less than the original packet length (don't they?), we've been writing pcaps from a usbkey that gives us packet captures without FCS, and I just set the snaplen to what we got, and they decode fine. Cheers, Sam - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
