But they all have the Base Header, and that header has:
3 bits of packet type;
1 bit of payload configuration;
1 bit of:
header mode, if the payload configuration bit is 0;
segmentation/concatenation, if the payload configuration bit is
1;
11 bits of length;
for a total of 16 bits, right?
Yes, unless the packet type is 111b in which case there the header is only 8
bits - you have the packet type, 4 bits indicating the count of TS frames
(where 0 means a count of 16) and 1 bit indicating if header deletion mode is
used.
If so, in a capture file:
1) the Base Header has 2 octets - in what order in the file are the two
octets?
2) in what order are the bit fields?
Order - byte at a time, most significant bit first.
The first 3 bits are the packet type - ie the most significant 3 bits of the
first byte.
For example, does the first octet of a packet contain:
3 bits of packet type in its upper 3 bits;
1 bit of payload configuration in the next lower bit;
1 bit of header mode or of segmentation/concatenation in the next lower
bit;
the uppermost 3 bits of length in the lowest 3 bits;
and does the second octet contain the lowermost 8 bits of length?
Correct, noting that the length field can be larger than 11 bits as follows:
payload_configuration = 0, header_mode = 0: the length field is 3+8=11 bits
long.
payload_configuration = 0, header_mode = 1: the third byte contains another 5
bits of length (most significant) making the length field 16 bits long.
payload_configuration = 1, segmentation_concatenation = 0: the length field is
3+8=11 bits long.
payload_configuration = 1, segmentation_concatenation = 1: the third byte
contains another 4 bits of length (most significant) making the length field 15
bits long.
If the packet type is 4 (link layer signaling packet) then there is an
additional 5 bytes of link layer signaling header after the optional headers,
before you start counting the length.
BTW - packets seem to often contain junk at the end.
Nick
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
