Re: [tcpdump-workers] Request for DLT_ for Endace's network monitoring

Gregor Maier wrote: yes it would. It's a bit superfluous (although ERF timestamps are more accurate) but the main reason we need the DLTs is to get the correct offsets (off_nl, off_mac, etc.) in gencode.c. At the moment these cards use the "native" DLTs of the interface and filtering is done using

Re: [tcpdump-workers] Request for DLT_ for Endace's network monitoring

Guy Harris wrote: > > On Feb 2, 2005, at 6:01 PM, Gregor Maier wrote: > >> We'd like to get two DLTs, namely DLT_ERF_ETH and DLT_ERF_POS. The DAG >> range of network monitoring cards prepend an additional ERF header (see >> http://www.endace.com/support/EndaceRecordFormat.pdf for further >> infor

Re: [tcpdump-workers] Request for DLT_ for Endace's network monitoring cards

On Feb 2, 2005, at 6:01 PM, Gregor Maier wrote: We'd like to get two DLTs, namely DLT_ERF_ETH and DLT_ERF_POS. The DAG range of network monitoring cards prepend an additional ERF header (see http://www.endace.com/support/EndaceRecordFormat.pdf for further information) to the actual link layer data,

[tcpdump-workers] Request for DLT_ for Endace's network monitoring cards

Hi, We'd like to get two DLTs, namely DLT_ERF_ETH and DLT_ERF_POS. The DAG range of network monitoring cards prepend an additional ERF header (see http://www.endace.com/support/EndaceRecordFormat.pdf for further information) to the actual link layer data, so we would need these new DLTs for corre