On Mar 25, 2013, at 2:48 AM, Tomasz Moń <deso...@gmail.com> wrote:
> For the USBPcap project I would like to request a new link-layer
> header type value:
> LINKTYPE_USBPCAP
> DLT_USBPCAP
>
> Capture format specification is available at the project website [1]
> and could be described as pseudo-header for USB packets captured using
> USBPcap on Microsoft Windows.
> #pragma pack(1)
> typedef struct
> {
> USHORT headerLen; /* This header length */
> UINT64 irpId; /* I/O Request packet ID */
So headerLen is at an offset of 0, and irpId is at an offset of 2, right?
> o irpId is merely a pointer to IRP casted to the UINT64
I.e., it's an 64-bit cookie whose bits have no particular significance, given
that, within a file, there's nothing for it to point to.
> o transfer determines the transfer type and thus the header type. See
> below for details.
> o dataLength specifies the total length of transfer data to follow
> directly after the header.
> Transfer-specific headers
Presumably the "transfer-specific header" follows the
USBPCAP_BUFFER_PACKET_HEADER in the packet data, with the transfer data
following the transfer-specific header.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
