Re: [tcpdump-workers] Request for new pcap/pcapng DLT Format

2013-05-20 Thread Guy Harris
On May 13, 2013, at 1:04 PM, chris_bon...@selinc.com wrote: > 1) The relative timestamp is 8 bytes, the "left" and "right" components > are 32-bit integers representing the left and right-hand side of the > decimal point, respectively Seconds and 1/2^32ths of a second? Speaking of timestamps,

Re: [tcpdump-workers] Request for new pcap/pcapng DLT Format

2013-05-20 Thread Guy Harris
On May 20, 2013, at 6:54 PM, chris_bon...@selinc.com wrote: > Those names sound good to me for the RTAC serial captures. OK, I've assigned 250 for LINKTYPE_RTAC_SERIAL and DLT_RTAC_SERIAL. > After looking a little closer, I suspect that since the RTAC platform is > Linux-based, the programmer

Re: [tcpdump-workers] Request for new pcap/pcapng DLT Format

2013-05-20 Thread chris_bontje
Hi Guy, Those names sound good to me for the RTAC serial captures. After looking a little closer, I suspect that since the RTAC platform is Linux-based, the programmers used the libpcap library to perform captures and that library is responsible for the output of the SLL format. I'll revise t

Re: [tcpdump-workers] Request for new pcap/pcapng DLT Format

2013-05-20 Thread Guy Harris
On May 13, 2013, at 1:04 PM, chris_bon...@selinc.com wrote: > Hi, I would like to request a custom DLT type for the Schweitzer > Engineering Laboratories "RTAC" product. Information on the > product/purpose of the DLT is included below: Do LINKTYPE_RTAC_SERIAL/DLT_RTAC_SERIAL sound like good