[tcpdump-workers] Speed specific Link-Layer Header Types for USB 2.0

2022-05-08 Thread Tomasz Moń via tcpdump-workers
--- Begin Message --- Hello, Back in 2019 I have requested Link-Layer Header Type for USB 2.0 [1]. Unfortunately, I didn't foresee the problems with dissecting packets at effectively "unknown" capture speed. That is, while the host, device and capture tool were all aware about the speed, the resul

Re: [tcpdump-workers] Speed specific Link-Layer Header Types for USB 2.0

2022-05-08 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On May 8, 2022, at 4:48 AM, Tomasz Moń via tcpdump-workers wrote: > I would like to remedy the situation by requesting additional speed > specific link layer header types, for example: > * LINKTYPE_USB_2_0_LOW_SPEED > * LINKTYPE_USB_2_0_FULL_SPEED > * LINKTYPE_USB_2_0_HI

Re: [tcpdump-workers] Speed specific Link-Layer Header Types for USB 2.0

2022-05-08 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On May 8, 2022, at 1:30 PM, Michael Richardson wrote: > I guess I would have thought that a physical bus could have a mix of > different devices which operate at different speeds. As such, I wondered if > you really needed pcapng to be able to mix LINKTYPES in the same file

Re: [tcpdump-workers] Speed specific Link-Layer Header Types for USB 2.0

2022-05-08 Thread Tomasz Moń via tcpdump-workers
--- Begin Message --- On Sun, May 8, 2022 at 8:53 PM Guy Harris wrote: > At least from a quick look at section 5.2.3 "Physical Bus Topology" of the > USB 2.0 spec, a given bus can either be a high-speed bus or a full/low-speed > bus. The full/low-speed bus applies only to upstream link from ful

Re: [tcpdump-workers] Speed specific Link-Layer Header Types for USB 2.0

2022-05-08 Thread Tomasz Moń via tcpdump-workers
--- Begin Message --- On Sun, May 8, 2022 at 11:15 PM Guy Harris wrote: > On May 8, 2022, at 1:30 PM, Michael Richardson wrote: > > I guess I would have thought that a physical bus could have a mix of > > different devices which operate at different speeds. As such, I wondered if > > you really