Re: [tcpdump-workers] New page, giving link-layer header type values

2011-03-15 Thread Sam Roberts
On Tue, Mar 15, 2011 at 8:59 PM, Guy Harris wrote: > On Mar 15, 2011, at 8:27 PM, Sam Roberts wrote: > >> Why would anyone want to deduce this? In wireshark, both dlt values >> will map to the same dissector, > > They *shouldn't* map to the same dissector.  They should map to *different* > dissec

Re: [tcpdump-workers] New page, giving link-layer header type values

2011-03-15 Thread Guy Harris
On Mar 15, 2011, at 8:27 PM, Sam Roberts wrote: > Why would anyone want to deduce this? In wireshark, both dlt values > will map to the same dissector, They *shouldn't* map to the same dissector. They should map to *different* dissector routines, which call a common routine, passing an "FCS pr

Re: [tcpdump-workers] New page, giving link-layer header type values

2011-03-15 Thread Sam Roberts
On Tue, Mar 15, 2011 at 6:41 PM, Guy Harris wrote: > On Mar 15, 2011, at 5:58 PM, Sam Roberts wrote: >> Whether or not the radio chips give the FCS to you when you run them >> in sniffer mode depends on the chip. Many just validate the FCS, strip >> it, and pass you the packet minus the FCS, but s

Re: [tcpdump-workers] New page, giving link-layer header type values

2011-03-15 Thread Guy Harris
On Mar 15, 2011, at 5:58 PM, Sam Roberts wrote: > It sounds like you think there are two variants of 802.15.4, one with > an FCS, and one without. No, I don't think that. Perhaps I need to rename the page, and change the language in it to make this even clearer. I originally said "link-layer

Re: [tcpdump-workers] New page, giving link-layer header type values

2011-03-15 Thread Sam Roberts
On Tue, Mar 15, 2011 at 5:11 PM, Guy Harris wrote: > On Mar 15, 2011, at 4:51 PM, Sam Roberts wrote: > >> On Sun, Mar 13, 2011 at 2:41 PM, Guy Harris wrote: >>>        http://www.tcpdump.org/linktypes.html >>> >>> contains a description of all the existing link-layer header types for >>> which t

Re: [tcpdump-workers] New page, giving link-layer header type values

2011-03-15 Thread Guy Harris
On Mar 15, 2011, at 4:51 PM, Sam Roberts wrote: > On Sun, Mar 13, 2011 at 2:41 PM, Guy Harris wrote: >>http://www.tcpdump.org/linktypes.html >> >> contains a description of all the existing link-layer header types for which >> there is either > > Not sure why there is two link types f

Re: [tcpdump-workers] New page, giving link-layer header type values

2011-03-15 Thread Sam Roberts
On Sun, Mar 13, 2011 at 2:41 PM, Guy Harris wrote: >        http://www.tcpdump.org/linktypes.html > > contains a description of all the existing link-layer header types for which > there is either Not sure why there is two link types for IEEE 802.15.4. The "no FCS at the end" case doesn't need