On Sep 6, 2011, at 11:01 PM, <[email protected]> <[email protected]> wrote:
> >> Will there ever be both "normal mode" and "transparent mode" packets > in >> the same capture file? If not, perhaps transparent mode should have > its >> own link-layer type value. > > The two modes will never be mixed up in one file. Having a second > link-layer type would be nice. So the preamble is the 7 octets described in section 3.2.1 of IEEE 802.3-2008 (0xAA 0xAA 0xAA 0xAA 0xAA 0xAA 0xAA, if the frame is valid), and the SFD is the octet described in section 3.2.2 (0xAB, if the frame is valid)?- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
