--- Begin Message ---
On 1/6/22 1:22 PM, Guy Harris wrote:
CAUTION: This email originated from outside of the organization. Do not click
links or open attachments unless you recognize the sender and know the content
is safe.
On Jan 5, 2022, at 6:53 PM, Timotej Ecimovic <timotej.ecimo...@silabs.com>
wrote:
No. Like the document describes: tooling that deals with deframing is expected
to remove the starting `[`, the ending `]` and the 2 byte length right after
the `[`.
In case of creating a PCAPNG file out of this stream, the payload of the packet blocks
will NOT contain the framing. So the "packet" starts with the debug message.
I.e., in LINKTYPE_SILABS_DEBUG_CHANNEL files, the packet doesn't include the
'[', the length value, or the ']'?
Correct. The "packet" inside the PCAP files will only include the
payload that is wedged between `[`, the two length bytes, and the `]`.
As far as PCAP files are concerned, this whole debate about framing is
just "informative", and might be helpful for people who will attempt to
understand how the TCP/IP stream of this incoming data turns into
individual "packets" inside PCAP files.
We also have tooling that are NOT performing deframing, but simply
record raw streams of data. If someone encounters those files, then this
framing information will help them convert those raw binary files into
PCAP files.
I will make this more explicit in the document. It was clearly a bit
confusing.
What do the bits in the "Flags" field of the 3.0 debug message mean? Does "few
bytes of future-proofing flags" mean that there are currently no flag bits defined, so that
the field should always be zero, but there might be flag bits defined in the future?
They mean. "Reserved for future use". The value currently can be arbitrary and
until someone defines values for them, they have no meaning. I'll make this more specific
in the doc.
So is there something in the debug message to indicate whether the field has no
meaning and should be ignored, or has a meaning and should be interpreted?
Yes. The version. If the version is 3, then these are "Undefined,
reserved for future use". If the version becomes greater than 3, then
these may develop meaning.
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
