> >> So do LINKTYPE_BLUETOOTH_LE_LL/DLT_BLUETOOTH_LE_LL packets include the > >> preamble octet and the CRC? > > > > They include the 3 octet CRC, they do not include the preamble. > > OK, I'll update the description on the "link-layer header types" page to note > that. > > So the packet in the file has: > > 4 bytes of Access Address; > > 2-39 bytes of packet data; > > 3 bytes of CRC; > > in sequential order, with nothing separating them, right?
Correct. > > To validate the CRC you must know a per-connection CrcInit. This value > > will be stored in the PPI with each packet. > > "Stored in the PPI"? Does that mean "stored in per-packet information > kept by the program reading the capture file", or does it mean > "per-packet information stored *in* the capture file"? If the latter, > that presumably means there's some form of pseudo-header preceding the > Access Address. I prepend a PPI packet header to the packet, which includes the DLT (thank you for assigning!) and some metadata about the packet and the state of the Ubertooth during capture. I've attached a screenshot: you can see the old version of the PPI header (lacks CrcInit), the USER0 DLT, and the 18 bytes of data captured from the air. 18 = 4 byte AA + 2 byte header + 9 byte data + 3 byte CRC
_______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
