Re: [tcpdump-workers] [PATCH] SocketCAN support for libpcap - draft

2009-10-11 Thread Alexander Dupuy
I wrote: If you ever think that SocketCAN/libpcap will be used on big-endian systems, you might want to "canonicalize" the layout in the big-endian format Guy Harris replied: Linux USB leaves the pseudo-header in host byte order - and, in the code that reads the savefile, libpcap byte-swaps t

Re: [tcpdump-workers] [PATCH] SocketCAN support for libpcap - draft implementation

2009-10-11 Thread Guy Harris
On Oct 11, 2009, at 2:58 AM, Felix Obenhuber wrote: On Fri, 2009-10-09 at 08:27 -0400, Alexander Dupuy wrote: ... Summing up the discussion till now, I'd like to request a new DLT for SocketCAN that is called DLT_CAN_SOCKETCAN OK, I've assigned 227 to DLT_CAN_SOCKETCAN, and check

Re: [tcpdump-workers] [PATCH] SocketCAN support for libpcap - draft implementation

2009-10-11 Thread Felix Obenhuber
On Fri, 2009-10-09 at 08:27 -0400, Alexander Dupuy wrote: > Given these differences between the two frame formats I would suggest > that you use a new DLT for SocketCAN, especially as there would be no > way to know for sure whether the flags were present or just padding (a > packet with all zero f

Re: [tcpdump-workers] [PATCH] SocketCAN support for libpcap -

2009-10-11 Thread Felix Obenhuber
On Sun, 2009-10-04 at 16:40 -0700, Guy Harris wrote: > > 3. The identification of the device index is quite a hack. I'm > > "parsing" > > the device name for an int before $. Any Ideas how to improve? > > That's what pcap-usb-linux.c does, so I'm not sure any improvement is > needed, other tha