Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2013-12-29 Thread Guy Harris
On Dec 27, 2013, at 3:13 AM, Michal Labedzki wrote: > 1. Bluetooth Linux Monitor use psedoheader to provide Opcode and > Adater Id which are required to correctly dissect payload (like > Bluetooth H4 with pseudoheader) What is the detailed format of the pseudo-header, and what is the payload th

Re: [tcpdump-workers] Request for DLT for Linux Kernel Messages

2013-12-29 Thread Guy Harris
On Dec 20, 2013, at 3:38 AM, Michal Labedzki wrote: > Linux kernel message have packet structure (one log/event = one packet) ...and the packet format is just a line containing text, so that the packet data is just N bytes of text (presumably without an NL at the end), with a bunch of comma-s

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2013-12-29 Thread Michal Labedzki
Hello, You can see code in Wireshark side (great example, very similar, but this is only support for capture file changes): https://bugs.wireshark.org/bugzilla/attachment.cgi?id=12394 Implementation in libpcap is very similar to pcap-bt-linux.c, but: 1. There is only one interface, let call it bl