Re: [tcpdump-workers] tcpdump filter question

2005-01-09 Thread Guy Harris
Peter Rabbitson wrote: The only thing I still do not understand is why the frame control field is passed to me in inverse-BIT order (I understand the BYTE inversion on an intel system, Actually, for 802.11, at least, the two bytes of the frame control field are *not* inverted on little-endian sy

Re: [tcpdump-workers] tcpdump filter question

2005-01-09 Thread Peter Rabbitson
On Sun, Jan 09, 2005 at 04:02:56PM -0800, Guy Harris wrote: > Peter Rabbitson wrote: > > >I am trying to capture only data packets from a 802.11b stream (no > >beacons, no control frames). Pages 50 and 51 of > >http://standards.ieee.org/getieee802/download/802.11-1999.pdf lead me to > >believe

Re: [tcpdump-workers] Request for DLT

2005-01-09 Thread Guy Harris
Gcom, Inc. wrote: We expect the majority of the carried traffic to be LAPD or LAPB/X.25, with some Frame Relay and SS7 thrown in for good measure. We've defined a per-frame header that includes the next protocol above it, so either the end-user can configure it explicitly or possibly an expert

Re: [tcpdump-workers] tcpdump filter question

2005-01-09 Thread Guy Harris
Peter Rabbitson wrote: I am trying to capture only data packets from a 802.11b stream (no beacons, no control frames). Pages 50 and 51 of http://standards.ieee.org/getieee802/download/802.11-1999.pdf lead me to believe that I am looking for a packet with the first byte being 0001 (in table