On Sep 2, 2011, at 12:53 AM, <[email protected]> <[email protected]> wrote:
>>> uiTransparent: >>> 0: normal Ethernet mode >>> 1: transparent capture mode >> >> Is there any difference between the packets in those two modes? > > Yes, this will include the preamble/SFD as supplied by the Ethernet-PHY. > This is used as low-level analysis expert mode. > > pcaprec_hdr_t: > ts_sec > ts_usec > incl_len > orig_len > packet_data: > preamble > SFD > dst_mac > src_mac > len_type > fcs > NETANA_HEADER_T Will there ever be both "normal mode" and "transparent mode" packets in the same capture file? If not, perhaps transparent mode should have its own link-layer type value. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
